Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
LisectAVT_2403002C_44.exe

Overview

General Information

Sample name:LisectAVT_2403002C_44.exe
Analysis ID:1481333
MD5:2427ff6ae2a31ddb6249669ce8e470cd
SHA1:bc54082f64c27b63ab35927b8b5b69f15518146c
SHA256:dc3f8a774e309c5f9789137fe97d0767da4399d09d5f7d4ec3c912409aaf4417
Tags:exe
Infos:

Detection

EICAR
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Yara detected AntiVM3
Yara detected EICAR
Yara detected UAC Bypass using CMSTP
AI detected suspicious sample
Allocates memory in foreign processes
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to infect the boot sector
Creates HTML files with .exe extension (expired dropper behavior)
Creates a FSFilter Anti-Virus service
Drops script or batch files to the startup folder
Hooks winsocket function (used for sniffing or altering network traffic)
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for sample
Modifies the prolog of user mode functions (user mode inline hooks)
Query firmware table information (likely to detect VMs)
Reads the Security eventlog
Reads the System eventlog
Sample is not signed and drops a device driver
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes many files with high entropy
Writes to foreign memory regions
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates driver files
Creates files inside the driver directory
Creates files inside the system directory
Creates or modifies windows services
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables driver privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Installs a raw input device (often for capturing keystrokes)
Is looking for software installed on the system
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file does not import any functions
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Spawns drivers
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected PsExec sysinternal tool
Yara signature match

Classification

Process Tree

  • System is w10x64
  • LisectAVT_2403002C_44.exe (PID: 2440 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002C_44.exe" MD5: 2427FF6AE2A31DDB6249669CE8E470CD)
    • MSBuild.exe (PID: 7644 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
      • YBwX8KjTjRCKU7PVUt7ohrmo.exe (PID: 8140 cmdline: "C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe" /s MD5: CD4ACEDEFA9AB5C7DCCAC667F91CEF13)
        • 360TS_Setup.exe (PID: 4872 cmdline: "C:\Users\user\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= MD5: B56AE4EF6D244BC96CE23A140FF0411E)
          • 360TS_Setup.exe (PID: 1548 cmdline: "C:\Program Files (x86)\1721892447_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall MD5: B56AE4EF6D244BC96CE23A140FF0411E)
      • r0raHcCIH1k2YsFlLn2OIQyk.exe (PID: 336 cmdline: "C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exe" /s MD5: CD4ACEDEFA9AB5C7DCCAC667F91CEF13)
        • WerFault.exe (PID: 5616 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 984 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • DD12FHVAYroWK47l2n2nUb6f.exe (PID: 1928 cmdline: "C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exe" /s MD5: CD4ACEDEFA9AB5C7DCCAC667F91CEF13)
        • WerFault.exe (PID: 4240 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 976 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • 87AZujGvMD0DS3bxBzittT7r.exe (PID: 6228 cmdline: "C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exe" /s MD5: CD4ACEDEFA9AB5C7DCCAC667F91CEF13)
        • WerFault.exe (PID: 7128 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6228 -s 976 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • vG59IrPYDLqWmCOO9Pfbpgeu.exe (PID: 6844 cmdline: "C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exe" /s MD5: CD4ACEDEFA9AB5C7DCCAC667F91CEF13)
        • WerFault.exe (PID: 5188 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 984 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • 7FamwTPi2SttiX4DgdTFvBP1.exe (PID: 4132 cmdline: "C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exe" /s MD5: CD4ACEDEFA9AB5C7DCCAC667F91CEF13)
        • WerFault.exe (PID: 2548 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 972 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • 5HEEZMiEnWqR242MeEoxlGRh.exe (PID: 1252 cmdline: "C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe" /s MD5: CD4ACEDEFA9AB5C7DCCAC667F91CEF13)
      • vjkQvA9A1258BKNJpE9OFR7r.exe (PID: 5172 cmdline: "C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exe" /s MD5: CD4ACEDEFA9AB5C7DCCAC667F91CEF13)
    • WerFault.exe (PID: 7740 cmdline: C:\Windows\system32\WerFault.exe -u -p 2440 -s 3156 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • svchost.exe (PID: 6604 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 5860 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • SgrmBroker.exe (PID: 4948 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)
  • svchost.exe (PID: 3180 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 1432 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 7184 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 7236 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 7444 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 7592 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 7668 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 7720 cmdline: C:\Windows\system32\WerFault.exe -pss -s 460 -p 2440 -ip 2440 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
    • WerFault.exe (PID: 744 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 336 -ip 336 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 4268 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1928 -ip 1928 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 6028 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6228 -ip 6228 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 4864 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6844 -ip 6844 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 4312 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4132 -ip 4132 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • svchost.exe (PID: 7852 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 8176 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cmd.exe (PID: 2232 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aWJAM7LmGVjrqyGFkBX76m6y.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 1340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2156 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jLw9YTEqZHJtGfgAlmf6QvQQ.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 1888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\qex.dllJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
    C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\ramengine.dllGandcrabGandcrab Payloadkevoreilly
    • 0xdbd00:$string1: GDCB-DECRYPT.txt
    C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360rp.dllJoeSecurity_EICARYara detected EICARJoe Security
      C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\appd.dllJoeSecurity_PsExecYara detected PsExec sysinternal toolJoe Security

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
          Process Memory Space: LisectAVT_2403002C_44.exe PID: 2440JoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
            Process Memory Space: LisectAVT_2403002C_44.exe PID: 2440JoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              0.2.LisectAVT_2403002C_44.exe.251659130c8.2.raw.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
                0.2.LisectAVT_2403002C_44.exe.25165915b08.1.raw.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security

                  Sigma Signatures

                  System Summary

                  barindex
                  Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe" /start, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\1721892447_0\360TS_Setup.exe, ProcessId: 1548, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QHSafeTray
                  Sigma detected: Windows Processes Suspicious Parent Directory
                  Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6604, ProcessName: svchost.exe

                  Data Obfuscation

                  barindex
                  Sigma detected: Drops script at startup location
                  Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7644, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dFBhuG7x7cuyTo0UEY1FLx3F.bat

                  Snort Signatures

                  ⊘No Snort rule has matched

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Antivirus / Scanner detection for submitted sample
                  Source: LisectAVT_2403002C_44.exeAvira: detected
                  Multi AV Scanner detection for submitted file
                  Source: LisectAVT_2403002C_44.exeReversingLabs: Detection: 50%
                  AI detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 93.8% probability
                  Machine Learning detection for sample
                  Source: LisectAVT_2403002C_44.exeJoe Sandbox ML: detected

                  Exploits

                  barindex
                  Yara detected UAC Bypass using CMSTP
                  Source: Yara matchFile source: 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: LisectAVT_2403002C_44.exe PID: 2440, type: MEMORYSTR
                  Source: LisectAVT_2403002C_44.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: Binary string: C:\Users\user\Desktop\LisectAVT_2403002C_44.PDB source: LisectAVT_2403002C_44.exe, 00000000.00000002.1538127572.000000EFC50F3000.00000004.00000010.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\mscorlib.pdbH source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.0000025100240000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\621001\out\Release\360boxmain.pdb source: 360boxmain.exe.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\372449\out\Release\SysCleanerUI.pdb source: SysCleanerUI.exe.42.dr
                  Source: Binary string: pC:\Users\user\Desktop\LisectAVT_2403002C_44.PDB source: LisectAVT_2403002C_44.exe, 00000000.00000002.1538127572.000000EFC50F3000.00000004.00000010.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\806392\out\Release\Installer.pdb source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1500985189.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1499687327.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1501833439.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1502015815.0000000004D81000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmp
                  Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.0000025100240000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.00000251003B3000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: c:\vmagent_new\bin\joblist\689163\src\3\360fsflt_sys_dbgad2_for_i18n\filter\objfre_win7_amd64\amd64\360FsFlt.pdb source: 360FsFlt_old.sys.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\55974\out\Release\360GuardBase.pdb source: 360GuardBase.dll.42.dr
                  Source: Binary string: \??\C:\Users\user\Desktop\LisectAVT_2403002C_44.PDB# source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.0000025100240000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\451438\out\Release\zh-CN\CloudSec3.dll.pdb source: cloudsec3.dll.locale11.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\500965\out\Release\MenuEx.pdb source: MenuEx.dll.42.dr
                  Source: Binary string: D:\Project\SafeGuardIntl\branches\SafeInt_V6.2\i18n\I18N\DsRes64\Release\zh-CN\DsRes64.pdb source: DsRes64.dll10.42.dr
                  Source: Binary string: LisectAVT_2403002C_44.PDB source: LisectAVT_2403002C_44.exe, 00000000.00000002.1538127572.000000EFC50F3000.00000004.00000010.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\435521\out\Release\360DeskAna.pdb source: 360DeskAna.exe.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\329925\out\Release\LiveUpdate360.pdb source: LiveUpdate360.exe.42.dr
                  Source: Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.00000251003B3000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: c:\vmagent_new\bin\joblist\320146\src\q\qutmipc_obtracer_sys\hookportregchangedriver\objfre_wxp_x86\i386\qutmipc.pdb source: qutmipc_win10.sys.42.dr
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.00000251003B3000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: mscorlib.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.00000251003B3000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\451442\out\Release\pt\DsRes.pdb source: DsRes.dll5.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\396552\out\Release\BootLeakFixer.pdb source: BootLeakFixer.tpi.42.dr
                  Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbolean) source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.0000025100240000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447668964.0000000002561000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1831668320.00000000025BB000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: c:\vmagent_new\bin\joblist\606617\src\3\360antihacker_driver\src\objfre_win7_amd64\amd64\360AntiHacker64.pdb source: 360AntiHacker64_win10.sys.42.dr
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.0000025100240000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\258920\out\Release\ru\UrlSettings.dll.pdb source: UrlSettings.dll.locale8.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb0pH| source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428070059.0000000000471000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495710361.0000000000471000.00000002.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554016071.0000000000471000.00000002.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572473034.0000000000471000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615615416.0000000000471000.00000002.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1630769787.0000000000471000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689360314.0000000000471000.00000002.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668954536.0000000000471000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741171716.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729446292.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786575405.0000000000471000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.dr
                  Source: Binary string: \??\C:\Windows\dll\mscorlib.pdbN source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.00000251003B3000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\329925\out\Release\LiveUpdate360.pdbtK source: LiveUpdate360.exe.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428070059.0000000000471000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495710361.0000000000471000.00000002.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554016071.0000000000471000.00000002.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572473034.0000000000471000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615615416.0000000000471000.00000002.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1630769787.0000000000471000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689360314.0000000000471000.00000002.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668954536.0000000000471000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741171716.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729446292.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786575405.0000000000471000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\815457\out\Release\en\filemgr.dll.pdb source: filemgr.dll.locale7.42.dr
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00429BF0 FindClose,lstrlenW,lstrlenW,lstrlenW,lstrcpyW,FindFirstFileW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,21_2_00429BF0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00428190 _memset,GetLogicalDriveStringsW,_memset,QueryDosDeviceW,21_2_00428190
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\WER\
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LisectAVT_240300_30926f56636b977de717efc0a33cc4ae6873153_8dafb6ee_37d64a93-2585-4cac-aad3-8809d659c484\
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_r0raHcCIH1k2YsFl_8cc313ba89e65827eb2b854a8ee3edf9cb9d41d6_6c9ad7ec_5564019a-2eb2-4a14-af3e-d6e5dd0bf216\

                  Networking

                  barindex
                  Creates HTML files with .exe extension (expired dropper behavior)
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: oPt6fSpHRKiTT7Q1TPCGqKkO.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: V0KULW0eofKGKwAPoyk1jLfW.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: V4FGFkKnEJS9DoImGBsPPCGl.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 8gVu8gjepN333150vcek3LTo.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: K8xiKDxfY6nPxIYPlvgH1pTk.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 8qKqy9BwD3yxFKs9FPzVbbUV.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 6zadM3w0LYJNq0HAyB6c8Jvg.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: BOYLJmOSydyd3al594lj0ZHm.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 3DN5iaTYoSMvSYVEgNVq6srw.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: xW9IehxgAMH1KYhEDWTYyuAV.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: Lqzz8bYqWlL5siF3Zd6Xfpqn.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: ZTC31vHrLGo214Qbz7YtQRrr.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: wZdNhoVbOYgB7TrwJAsCrFOW.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: Zb7nxqblpw7TLWHsBMAvUPsl.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: DZN9HaS2r82y90oqcDIGvbua.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: AP2lZUYLVb3fOVZjIJZoJ5uo.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: z5etLqtnoYB3uq0Gp2ryNMWh.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: mtdHWyrYhqmLIpIP9DyhL8FF.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: sYAdCucIdETYwti6zduaA4uc.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: UvEg1tNw8TQgEGoMoudW4MSA.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: n5eSui7h9Sj1Nl3mxAAYFshy.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: AcH6A3N4Yq3CItbLtQF82Zf4.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: CHlvcwjKXoNvEPi7AbbOuC76.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 4WEUkBG9JpgzYkC7tR5gp4Pg.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: RYKhEanOwC6FWik4A4mJOAN8.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: duwqdISRLLAFoMl7eGQzvk19.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 9fMPr9bjofOW56waLjTgg4fo.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: uvqLI8jE9ivm73yihaZdL8Gh.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: t9bICacqM5w9awp82pyv2NWK.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: uERxbc5vCWNlPNYfvjfoiyga.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: valfJVofmQis2rSwBAURTfbb.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: Nzvx14A6i1YARb0z8nCWnXqc.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: NPEDxjpZoYrdEERzjiUZxi6O.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: bHE9XM1pSzemxpAUTAD74htE.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 1IZVL6x1EXi1l4x68y4gFu3H.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: z6PTVReHORuE0SANRIydUy3R.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: SXah3THn9M8VoE65mbOGcxLZ.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: r6B3NzCfMBGhJGaBBWOTeOOy.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: VMlIObHT52VVzT4ZvJ2a0API.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: gfWrrNoU6cOZVXeoV8l1pMRW.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 8gHZdIpZQLlZm3sIFx1QuBpo.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: HZo5cr670ciKVqx5K7ZScfqY.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: uE4ZDB1En0ie6pdAAAmn6VpC.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: vebo40yZZ14NTRA0bT2wbaOK.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 1UJq8e2U2LX06ZYWItENFs3s.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: U7C9WzWkhs72ELqs0HGle9E1.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: ZQJxXnmsk8IWrmEeNzFuMqjd.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: evpB0G9LOHcHfChKbhcE1wKr.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 0tKUigrv8FZlFjBm6o7EVBkc.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 8a30HwudqUc8B2I1TPgQnnUM.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 5xh1kzRK1sY56wRtA0VfLbHM.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: uwboAo9LPiCMDGo10JP3xX6M.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: SsCm7Ag53eAdgIjMjAEokwsY.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: jeGjhHefWlrpFA9F19l2Ookm.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 0EWtjgbJif9Bin5wbnTDxdpr.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: m4PX6jHO1BAGyiLgBcjrjcWt.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: gBwXmFsqSOHvlyhYsCkYMJOA.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: 6l2OHZVq9ozMIVBLr01xSPSn.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: CXuRBddRChUEwLDDTAGzBHG0.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: jjsEbk9jQEccA6Qt56FDPpOc.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: wmjbSar71ZAYUF4cNnOUSNWf.exe.12.dr
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: Mwty6fi4Q3FKOsbAwfVnBGdO.exe.12.dr
                  Yara detected Generic Downloader
                  Source: Yara matchFile source: 0.2.LisectAVT_2403002C_44.exe.251659130c8.2.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.LisectAVT_2403002C_44.exe.25165915b08.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\appd.dll, type: DROPPED
                  Source: svchost.exe, 00000010.00000003.1448409308.0000015C50776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS
                  Source: svchost.exe, 00000010.00000003.1499888964.0000015C50774000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
                  Source: svchost.exe, 00000010.00000003.1399313091.0000015C50755000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb
                  Source: svchost.exe, 00000010.00000003.1448409308.0000015C50776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tbA
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498433469.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498956493.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1497138389.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: http://channel.360totalsecurity.com/ins?m2=%s&v611=%s&ch=%s&sch=%s%s?%skeyref_linkPhttps://orion.ts.
                  Source: LisectAVT_2403002C_44.exeString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
                  Source: svchost.exe, 00000010.00000003.1547578522.0000015C50774000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1547578522.0000015C5077A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1427532948.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1427511081.0000015C50707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
                  Source: svchost.exe, 00000010.00000003.1547734445.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1499514393.0000015C50708000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd$
                  Source: svchost.exe, 00000010.00000003.1446731078.0000015C50707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1547734445.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1516843933.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1500194162.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1500116412.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1531397342.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1499853606.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1429623040.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1471050197.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1547868831.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446842950.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1499514393.0000015C50708000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446761579.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1485923450.0000015C50707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1471187079.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1485751714.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1486023150.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1532475489.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1430130394.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1485869905.0000015C50707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1429978767.0000015C5070E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
                  Source: svchost.exe, 00000010.00000003.1446325265.0000015C50729000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA
                  Source: svchost.exe, 00000010.00000003.1448409308.0000015C50776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1547788294.0000015C50786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1547578522.0000015C50774000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1516297808.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1532385635.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1427532948.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1427511081.0000015C50707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
                  Source: svchost.exe, 00000010.00000003.1485923450.0000015C50707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1485869905.0000015C50707000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd$
                  Source: svchost.exe, 00000010.00000003.1446731078.0000015C50707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1547734445.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1516843933.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1500194162.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1500116412.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1531397342.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1499853606.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1429623040.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1471050197.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1547868831.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446842950.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1499514393.0000015C50708000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446761579.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1485923450.0000015C50707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1471187079.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1485751714.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1486023150.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1532475489.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1430130394.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1485869905.0000015C50707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1429978767.0000015C5070E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
                  Source: svchost.exe, 00000010.00000003.1446325265.0000015C50729000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
                  Source: svchost.exe, 00000010.00000003.1446325265.0000015C50729000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
                  Source: svchost.exe, 00000010.00000003.1547578522.0000015C50774000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exeString found in binary or memory: http://down.360safe.com/setup.exe
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428070059.0000000000471000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495710361.0000000000471000.00000002.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554016071.0000000000471000.00000002.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572473034.0000000000471000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615615416.0000000000471000.00000002.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1630769787.0000000000471000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689360314.0000000000471000.00000002.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668954536.0000000000471000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741171716.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729446292.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786575405.0000000000471000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://down.360safe.com/setup.exePathSOFTWARE
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428097824.0000000000487000.00000008.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495741557.0000000000487000.00000008.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554060682.0000000000487000.00000008.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572589859.0000000000488000.00000008.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615728423.0000000000487000.00000008.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1631033297.0000000000488000.00000008.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668986779.0000000000487000.00000008.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689485723.0000000000488000.00000008.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741271820.0000000000488000.00000008.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729488267.0000000000487000.00000008.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786649072.0000000000487000.00000008.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.dr, BootLeakFixer.tpi.42.dr, 360GuardBase.dll.42.drString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428097824.0000000000487000.00000008.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495741557.0000000000487000.00000008.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554060682.0000000000487000.00000008.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572589859.0000000000488000.00000008.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615728423.0000000000487000.00000008.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1631033297.0000000000488000.00000008.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668986779.0000000000487000.00000008.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689485723.0000000000488000.00000008.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741271820.0000000000488000.00000008.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729488267.0000000000487000.00000008.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786649072.0000000000487000.00000008.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.dr, 360GuardBase.dll.42.drString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe360
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428097824.0000000000487000.00000008.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495741557.0000000000487000.00000008.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554060682.0000000000487000.00000008.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615728423.0000000000487000.00000008.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668986779.0000000000487000.00000008.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729488267.0000000000487000.00000008.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786649072.0000000000487000.00000008.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeBUTTONBUTTONProduct32Product64
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exeString found in binary or memory: http://down.360safe.com/setupbeta.exe
                  Source: svchost.exe, 00000002.00000003.1234453899.000001C456850000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://int.down.360safe.com/totalsecurity/360TS_Setup.exe/360-total-security/?offline=1P
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1460134591.0000000004140000.00000004.00000800.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1846696921.0000000004BF0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://int.down.360safe.com/totalsecurity/360TS_Setup_11.0.0.1118.exe
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697702948.00000000023B0000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741512061.000000000056E000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745425565.0000000002270000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786696250.000000000056E000.00000002.00000001.01000000.00000019.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cab
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cab.
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cab..)
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabSE.ca
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabY0
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabar.
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabar.a
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabc.
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabh
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505252122.0000000002355000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571833274.0000000002255000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627168153.00000000022B2000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627290975.00000000022B5000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688825368.00000000023D5000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688599283.00000000023D2000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740428113.0000000002292000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740525105.0000000002295000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabini
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571441481.0000000002252000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabini1
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabini2
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505123387.0000000002352000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabiniX-
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabiniiq
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688655164.00000000023CD000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688857753.00000000023CE000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697875146.00000000023CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab-du
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab5
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab?y
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428117468.000000000056E000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572935788.000000000056E000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1631437627.000000000056E000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1669011926.000000000056E000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741512061.000000000056E000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786696250.000000000056E000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabXhttp://www.360totalsecurity.c
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabboo
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabe
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabk
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabp=
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabu
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabw
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1514500363.0000000002330000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505169634.000000000234D000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1516086305.000000000234E000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505327774.000000000234E000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577705604.0000000002230000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633932242.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633792574.0000000002290000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627205903.00000000022AD000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627632367.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688655164.00000000023CD000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688857753.00000000023CE000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab.
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab.G
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab.T
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428117468.000000000056E000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572935788.000000000056E000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1631437627.000000000056E000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1669011926.000000000056E000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741512061.000000000056E000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786696250.000000000056E000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab9http://int.down.360safe.com/
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab?
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabY
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577967137.000000000224E000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571583298.000000000224D000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571920792.000000000224E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabb
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabp=
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabpo
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabupdate
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exeString found in binary or memory: http://pinst.360.cn/360se/wssj_setup.cab
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428070059.0000000000471000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495710361.0000000000471000.00000002.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554016071.0000000000471000.00000002.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572473034.0000000000471000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615615416.0000000000471000.00000002.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1630769787.0000000000471000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689360314.0000000000471000.00000002.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668954536.0000000000471000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741171716.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729446292.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786575405.0000000000471000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://pinst.360.cn/360se/wssj_setup.cabGdiplus.dllGdiplusStartupGdiplusShutdownGdipCreateFromHDCGdi
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exeString found in binary or memory: http://pinst.360.cn/zhuomian/desktopsafe.cab
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428070059.0000000000471000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495710361.0000000000471000.00000002.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554016071.0000000000471000.00000002.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572473034.0000000000471000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615615416.0000000000471000.00000002.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1630769787.0000000000471000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689360314.0000000000471000.00000002.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668954536.0000000000471000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741171716.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729446292.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786575405.0000000000471000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://pinst.360.cn/zhuomian/desktopsafe.cabSoftware
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exeString found in binary or memory: http://s.360safe.com/360ts/mini_inst.htm?ver=%s&pid=%s&os=%s&mid=%s&state=%d
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428070059.0000000000471000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495710361.0000000000471000.00000002.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554016071.0000000000471000.00000002.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572473034.0000000000471000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615615416.0000000000471000.00000002.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1630769787.0000000000471000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689360314.0000000000471000.00000002.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668954536.0000000000471000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741171716.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729446292.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786575405.0000000000471000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://s.360safe.com/360ts/mini_inst.htm?ver=%s&pid=%s&os=%s&mid=%s&state=%d&opr_state=%xhttp://s.36
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1448568992.000000000238B000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449689816.0000000002392000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449599585.0000000002392000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449492385.000000000238E000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1448591698.0000000002396000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446363762.0000000002398000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449569709.0000000002390000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449200062.0000000002396000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445393817.0000000002395000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449711698.0000000002396000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449043614.000000000238E000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830179551.00000000022D8000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834407043.00000000022CE000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834928278.00000000022D6000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834021388.00000000022D6000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834617239.00000000022D0000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1832980492.00000000022CB000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829786149.00000000022D5000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1833861603.00000000022CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/360ts/mini_inst.htm?ver=6.6.0.1054&pid=WW.Marketator.CPI20230405&os=10.0&mid=d1
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498433469.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498956493.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1497138389.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: http://s.360safe.com/safei18n/Administrators
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exeString found in binary or memory: http://s.360safe.com/safei18n/dimana.htm?lr=1&mid=%s&mod=360Installer.exe&ph=%s&p2p=1&t_id=%s&tads=%
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855390064.000000000883E000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.000000000883E000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008815000.00000004.00000020.00020000.00000000.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?%%
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?%%:
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?%%_1
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?era_
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?lr=
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?ng
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?privQ
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?s=0
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exeString found in binary or memory: http://s.360safe.com/safei18n/query_env.htm?%s=%s
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1833301778.00000000022CC000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834407043.00000000022CE000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1833154049.00000000022CC000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834617239.00000000022D0000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1833516971.00000000022D0000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1832980492.00000000022CB000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1833861603.00000000022CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/safei18n/query_env.htm?v611=DgY0MAEI%2Fchp3gABAACmjCwLXJT2BKW9WbDuCaK3D5AvEbW6%
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1448568992.000000000238B000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1448790828.000000000238C000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449689816.0000000002392000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449599585.0000000002392000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449492385.000000000238E000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1448687205.000000000238C000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449569709.0000000002390000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1455681127.0000000002393000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1448860757.0000000002390000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449043614.000000000238E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/safei18n/query_env.htm?v611=DgY0MAEIJbMLkwABAABdkHyH3QE0w3eO%2Fi6DpvdJWeEjanGax
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498433469.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498956493.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1497138389.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: http://s.360totalsecurity.com/safei18n/ins.htm?mid=%s&ver=%s&lan=%s&os=%s&ch=%s&sch=%s&ue=%sMainDlg7
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498433469.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498956493.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1497138389.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: http://s.360totalsecurity.com/safei18n/ins_pb.html?mid=%s&m2=%s&ver=%s&lan=%s&os=%s&ch=%s&sch=%s&ue=
                  Source: svchost.exe, 00000010.00000003.1427569515.0000015C5076E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1552419745.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1516297808.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1532385635.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
                  Source: svchost.exe, 00000010.00000003.1552419745.0000015C50766000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policywP
                  Source: svchost.exe, 00000010.00000003.1552419745.0000015C50766000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
                  Source: svchost.exe, 00000010.00000003.1552419745.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1516297808.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1532385635.0000015C5070F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
                  Source: svchost.exe, 00000010.00000003.1427569515.0000015C5076E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1399313091.0000015C50755000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
                  Source: svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1552419745.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
                  Source: svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue1
                  Source: svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1552419745.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
                  Source: svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustvP
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428117468.000000000056E000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572935788.000000000056E000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1631437627.000000000056E000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1669011926.000000000056E000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741512061.000000000056E000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786696250.000000000056E000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://www.360safe.com/totalsecurity/en/101/tswin10u/d7http://www.360safe.com/totalsecurity/en/101/t
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exeString found in binary or memory: http://www.360totalsecurity.com
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498433469.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498956493.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1497138389.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: http://www.360totalsecurity.com/d/ts/%s/%s/QHSafeTray.exe360Tray.exe%snosign.htm?f=%s&re=%s&mid=%s&v
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505454393.0000000002343000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1515849627.0000000002345000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688982664.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697781076.00000000023C5000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745574464.0000000002285000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740798763.0000000002283000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829918670.00000000022CB000.00000004.00000020.00020000.00000000.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://www.360totalsecurity.com/en/license.html
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449599585.0000000002392000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449492385.000000000238E000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1455625649.000000000239F000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449569709.0000000002390000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449666516.000000000239C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html$
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830002018.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html&
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html0
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html2
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html2aP
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449599585.0000000002392000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449492385.000000000238E000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1455625649.000000000239F000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449569709.0000000002390000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449666516.000000000239C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html4
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830002018.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html5
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html7
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html7H
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html;
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740492838.0000000002288000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html=7
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1448687205.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.html=W
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830002018.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlA
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlAA
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlB
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlHr
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlI
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1448687205.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlKV
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449599585.0000000002392000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449492385.000000000238E000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1455625649.000000000239F000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449569709.0000000002390000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449666516.000000000239C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlR
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlS.cab
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446133157.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlUV
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446133157.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlZV
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmla
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577827505.0000000002245000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1572060624.0000000002243000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmla#4
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505454393.0000000002343000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1515849627.0000000002345000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlaW
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688761933.00000000023C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmla_
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlarga-P
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830002018.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlc
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlde
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505201523.0000000002348000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmldeG
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmler
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlf
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlgXSn
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlh
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlim
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlimU(
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505201523.0000000002348000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlima
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlin
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmliv8
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlivE
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlivc
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlmex
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlml
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlmlyPKo
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1448687205.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlnW
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlne
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmloWEn
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740492838.0000000002288000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlop
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688761933.00000000023C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlpe
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlpey
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571704283.0000000002248000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlpo
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505399193.0000000002349000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505201523.0000000002348000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1515930204.000000000234A000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1572025710.0000000002249000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571704283.0000000002248000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577879075.000000000224A000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633898139.00000000022AA000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1628746877.00000000022A9000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688761933.00000000023C8000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688923614.00000000023C9000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697813786.00000000023CA000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740714177.0000000002289000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745625576.000000000228A000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740492838.0000000002288000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlpplied
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlpu-
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlr
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlr)
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlr=
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlr=6
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlra
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571704283.0000000002248000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlre
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlrgat
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834718379.00000000022C8000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834528638.00000000022C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmls
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlt
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmltd
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmluP
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740492838.0000000002288000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlup
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlup7
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlv
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlx
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmly
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmly&n
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446133157.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1448687205.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlyW
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlys
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834407043.00000000022CE000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834617239.00000000022D0000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834847695.00000000022DC000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1839826468.00000000022DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/license.htmlz.
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577827505.0000000002245000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1572060624.0000000002243000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633863682.00000000022A5000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1629073241.00000000022A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505169634.000000000234D000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1516086305.000000000234E000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505327774.000000000234E000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html$
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449599585.0000000002392000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449492385.000000000238E000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1455625649.000000000239F000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449569709.0000000002390000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449666516.000000000239C000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505169634.000000000234D000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1516086305.000000000234E000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505327774.000000000234E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html%
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1833154049.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html&
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html&X
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446133157.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html-V
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740462535.000000000228D000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745703760.000000000228E000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740558848.000000000228E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html/
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html0
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html0%%
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html0%%7
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html0%%T
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html2
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html5
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688761933.00000000023C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html7
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688655164.00000000023CD000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688857753.00000000023CE000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697875146.00000000023CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html8X
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505169634.000000000234D000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1516086305.000000000234E000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505327774.000000000234E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html:
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html;
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html=
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740492838.0000000002288000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html=7
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571704283.0000000002248000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html=7P
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html=7b(89
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834407043.00000000022CE000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834617239.00000000022D0000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834847695.00000000022DC000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1839826468.00000000022DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html?/
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlA
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlE
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlF
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlGhY
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633932242.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627205903.00000000022AD000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627632367.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlJ&(9
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834407043.00000000022CE000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834617239.00000000022D0000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834847695.00000000022DC000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1839826468.00000000022DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlJ/
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlK
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446133157.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlKV
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740462535.000000000228D000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745703760.000000000228E000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740558848.000000000228E000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlQ
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577967137.000000000224E000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571583298.000000000224D000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571920792.000000000224E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlQ%
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740462535.000000000228D000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745703760.000000000228E000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740558848.000000000228E000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlR
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlUn
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688655164.00000000023CD000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688857753.00000000023CE000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697875146.00000000023CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlVX
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlW
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740492838.0000000002288000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.html_
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmla=r
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740462535.000000000228D000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745703760.000000000228E000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740558848.000000000228E000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1833154049.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlb
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1833154049.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlc
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688655164.00000000023CD000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688857753.00000000023CE000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697875146.00000000023CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmldY
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlde
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505454393.0000000002343000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1515849627.0000000002345000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmldef
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740492838.0000000002288000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmle.
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmleminder=7
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlh
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmli
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlim
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlim?
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlimi
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlin
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlini
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmliv
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlivQ
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633932242.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627205903.00000000022AD000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627632367.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmll&
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlm
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlme
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlne
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633932242.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627205903.00000000022AD000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627632367.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlo
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688761933.00000000023C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlop
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlop;
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlp
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlpe
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlpe-
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlpg
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1833154049.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlq
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlr
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577967137.000000000224E000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571583298.000000000224D000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571920792.000000000224E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlr$
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlr=
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505201523.0000000002348000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlr=%
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlr=K
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlrU
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688761933.00000000023C8000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlre
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlrej
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmls
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmls=
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688655164.00000000023CD000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688857753.00000000023CE000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697875146.00000000023CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmluY
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlupq
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmly
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlyG
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/o
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505201523.0000000002348000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1515539628.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1515930204.000000000234A000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1572025710.0000000002249000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571704283.0000000002248000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577879075.000000000224A000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002231000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633898139.00000000022AA000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1628746877.00000000022A9000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688761933.00000000023C8000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688923614.00000000023C9000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023B1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697813786.00000000023CA000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740714177.0000000002289000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745625576.000000000228A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.html
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577767864.0000000002241000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633827080.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.html7
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.html=0
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.htmlc
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.htmlderp
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.htmlews=
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.htmlime
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.htmlope
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697739807.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.htmlra=
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688761933.00000000023C8000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688923614.00000000023C9000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023B1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697813786.00000000023CA000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740714177.0000000002289000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745625576.000000000228A000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740492838.0000000002288000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002271000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.html
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.html5
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.html7
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633827080.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.htmla=7
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.htmlder
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.htmler=
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745527705.0000000002281000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.htmlews
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.htmlins
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.htmlo
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577767864.0000000002241000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002231000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633898139.00000000022AA000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1628746877.00000000022A9000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688761933.00000000023C8000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A35000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688923614.00000000023C9000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023B1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697813786.00000000023CA000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740714177.0000000002289000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745625576.000000000228A000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740492838.0000000002288000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002271000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.html
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.html.
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.html7
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.html=0
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.htmla=7
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.htmlcab9
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.htmlera
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697739807.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.htmlews
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633827080.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745527705.0000000002281000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.htmlime
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.htmlins
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.htmlo
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505014675.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000003.1505201523.0000000002348000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1515539628.0000000002341000.00000004.00000020.00020000.00000000.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1515930204.000000000234A000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1572025710.0000000002249000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571704283.0000000002248000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577879075.000000000224A000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002231000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633898139.00000000022AA000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1628746877.00000000022A9000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688761933.00000000023C8000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688923614.00000000023C9000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023B1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697813786.00000000023CA000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740714177.0000000002289000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745625576.000000000228A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.html
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577767864.0000000002241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.html7
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.html=7
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.htmla=7
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.htmler=
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.htmlera
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697739807.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.htmlins
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.htmlmin
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633827080.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.htmlo
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1745527705.0000000002281000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.htmlra=
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428070059.0000000000471000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495710361.0000000000471000.00000002.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554016071.0000000000471000.00000002.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572473034.0000000000471000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615615416.0000000000471000.00000002.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1630769787.0000000000471000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689360314.0000000000471000.00000002.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668954536.0000000000471000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741171716.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729446292.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786575405.0000000000471000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: http://www.360totalsecurity.comIDS_LOAD_P2SP_ERROR/tswin10/tsewin10IDS_UPDATE_QUESTIONIDS_UPDATE_WAR
                  Source: svchost.exe, 00000003.00000002.1366082415.000002C2D3813000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C5072C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361447426.0000015C50756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361447426.0000015C50756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
                  Source: svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
                  Source: svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361130944.0000015C50757000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/msangcwam
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498433469.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1499558059.0000000003823000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498956493.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1497138389.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498985660.000000000381E000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://chrome.google.com/webstore/detail/360-internet-protection/glcimepnljoholdmjchkloafkggfoijhht
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498433469.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498956493.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1497138389.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crxcom.google.chrome.wdwedprofirefox.exeeEopennewIE.Asso
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
                  Source: svchost.exe, 00000003.00000002.1366434447.000002C2D3844000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1365040245.000002C2D3843000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364950065.000002C2D385A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366735784.000002C2D3863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366782010.000002C2D3881000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
                  Source: svchost.exe, 00000003.00000002.1366735784.000002C2D3863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
                  Source: svchost.exe, 00000003.00000002.1366782010.000002C2D3881000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
                  Source: svchost.exe, 00000003.00000002.1366216352.000002C2D383F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364950065.000002C2D385A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366735784.000002C2D3863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
                  Source: svchost.exe, 00000003.00000002.1366135413.000002C2D382B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366735784.000002C2D3863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
                  Source: svchost.exe, 00000003.00000002.1366216352.000002C2D383F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366735784.000002C2D3863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
                  Source: svchost.exe, 00000003.00000002.1366216352.000002C2D383F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
                  Source: svchost.exe, 00000003.00000002.1366434447.000002C2D3844000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1365040245.000002C2D3843000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366735784.000002C2D3863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
                  Source: svchost.exe, 00000003.00000003.1365023586.000002C2D384A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
                  Source: svchost.exe, 00000003.00000002.1366216352.000002C2D383F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
                  Source: svchost.exe, 00000003.00000002.1366735784.000002C2D3863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
                  Source: svchost.exe, 00000003.00000002.1366434447.000002C2D3844000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1365040245.000002C2D3843000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364687308.000002C2D385E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
                  Source: svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364687308.000002C2D385E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
                  Source: svchost.exe, 00000003.00000002.1366135413.000002C2D382B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366735784.000002C2D3863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
                  Source: svchost.exe, 00000002.00000003.1234453899.000001C4568A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
                  Source: svchost.exe, 00000002.00000003.1234453899.000001C456850000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447668964.00000000025B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srf
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361447426.0000015C50756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361447426.0000015C50756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
                  Source: svchost.exe, 00000010.00000003.1361205149.0000015C5076B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
                  Source: svchost.exe, 00000010.00000003.1361205149.0000015C5076B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
                  Source: svchost.exe, 00000010.00000003.1361205149.0000015C5076B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C5072C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ListSessions.srf
                  Source: svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srfe
                  Source: svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageLoginKeys.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageLoginKeys.srfrf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/didtou.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getrealminfo.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getuserrealm.srf
                  Source: svchost.exe, 00000010.00000003.1427569515.0000015C5076E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361205149.0000015C5076B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360803971.0000015C50710000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
                  Source: svchost.exe, 00000010.00000003.1361205149.0000015C5076B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
                  Source: svchost.exe, 00000010.00000003.1361237309.0000015C50727000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
                  Source: svchost.exe, 00000010.00000003.1427569515.0000015C5076E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361205149.0000015C5076B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361237309.0000015C50727000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
                  Source: svchost.exe, 00000010.00000003.1361205149.0000015C5076B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
                  Source: svchost.exe, 00000010.00000003.1361237309.0000015C50727000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
                  Source: svchost.exe, 00000010.00000003.1361205149.0000015C5076B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
                  Source: svchost.exe, 00000010.00000003.1361205149.0000015C5076B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C5072C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
                  Source: svchost.exe, 00000010.00000003.1485720042.0000015C5075A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-DthxNMvdXbruAUlcqvcNFbBf1CkG7V4BHIiL7xrq
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361447426.0000015C50756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
                  Source: svchost.exe, 00000010.00000003.1427569515.0000015C5076E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361205149.0000015C5076B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C5072C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
                  Source: svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=805021
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361447426.0000015C50756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806033
                  Source: svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361130944.0000015C50757000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C5072C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360825704.0000015C5075A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
                  Source: svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
                  Source: svchost.exe, 00000010.00000003.1360803971.0000015C50710000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/resetpw.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/retention.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
                  Source: svchost.exe, 00000010.00000003.1360803971.0000015C50710000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
                  Source: svchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
                  Source: svchost.exe, 00000010.00000003.1360803971.0000015C50710000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
                  Source: svchost.exe, 00000010.00000003.1361237309.0000015C50727000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
                  Source: svchost.exe, 00000010.00000003.1360803971.0000015C50710000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
                  Source: svchost.exe, 00000010.00000003.1360803971.0000015C50710000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exeString found in binary or memory: https://orion.ts.360.com/promo/opera?ch=%s&sch=%s&ver=%s&lan=%s&os=%s&mid=%s&mver=%s&time=%I64d
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428070059.0000000000471000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495710361.0000000000471000.00000002.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554016071.0000000000471000.00000002.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572473034.0000000000471000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615615416.0000000000471000.00000002.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1630769787.0000000000471000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689360314.0000000000471000.00000002.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668954536.0000000000471000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741171716.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729446292.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786575405.0000000000471000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drString found in binary or memory: https://orion.ts.360.com/promo/opera?ch=%s&sch=%s&ver=%s&lan=%s&os=%s&mid=%s&mver=%s&time=%I64d/down
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.00000251658A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/xYhKBupz1https://yip.su/RNWPd.exe7https://iplogger.com/1uNwK4
                  Source: LisectAVT_2403002C_44.exeString found in binary or memory: https://sectigo.com/CPS0
                  Source: svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50755000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C5072C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signup.live.com/signup.aspx
                  Source: svchost.exe, 00000003.00000003.1365072003.000002C2D3832000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtuHV
                  Source: svchost.exe, 00000003.00000003.1365072003.000002C2D3832000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.hT
                  Source: svchost.exe, 00000003.00000003.1365040245.000002C2D3843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
                  Source: svchost.exe, 00000003.00000003.1365023586.000002C2D384A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
                  Source: svchost.exe, 00000003.00000003.1365023586.000002C2D384A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
                  Source: svchost.exe, 00000003.00000003.1364758050.000002C2D385D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
                  Source: svchost.exe, 00000003.00000002.1366135413.000002C2D382B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
                  Source: svchost.exe, 00000003.00000003.1365072003.000002C2D3832000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.akS
                  Source: svchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ar/experience.html
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ar/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ar/license/360-total-security-essential/Cu
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ar/license/360-total-security/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ar/privacy/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/de/experience.html
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/de/experience.htmlA
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/de/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1855390064.000000000887B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/de/license/360-total-security-essential/a
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/de/license/360-total-security-essential/wt
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/de/license/360-total-security/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/de/privacy/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/de/privacy/.$
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/de/privacy/rg
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/experience.html
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/experience.html60
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/license/360-total-security/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/license/360-total-security/%
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/privacy/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/privacy/60-tot
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/es/experience.html
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/es/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/es/license/360-total-security-essential/Z
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/es/license/360-total-security/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/es/privacy/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/fr/experience.html
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/fr/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1855390064.000000000887B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/fr/license/360-total-security-essential/1fGB
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/fr/license/360-total-security/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/fr/privacy/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/fr/privacy/lo
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/hi/experience.html
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/hi/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/hi/license/360-total-security/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/hi/license/360-total-security/Iz
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/hi/privacy/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/it/experience.html
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/it/experience.htmlr
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/it/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/it/license/360-total-security-essential/-
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/it/license/360-total-security-essential/.
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855390064.000000000887B000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/it/license/360-total-security/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/it/privacy/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/it/privacy/5
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/it/privacy/y/og
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ja/experience.html
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ja/experience.htmlQ
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ja/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ja/license/360-total-security/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ja/privacy/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pl/experience.html
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pl/experience.htmlG
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pl/experience.htmlS
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pl/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1855390064.000000000887B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pl/license/360-total-security-essential/&#/a
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pl/license/360-total-security-essential/Hpz
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pl/license/360-total-security-essential/r.
                  Source: 360TS_Setup.exe, 0000002A.00000003.1855390064.000000000887B000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pl/license/360-total-security/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pl/privacy/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pt/experience.html
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pt/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pt/license/360-total-security/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/pt/privacy/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ru/experience.html
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ru/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ru/license/360-total-security-essential/.
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ru/license/360-total-security/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/ru/privacy/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/tr/experience.html
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/tr/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/tr/license/360-total-security/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/tr/privacy/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/vi/experience.html
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/vi/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/vi/license/360-total-security/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/vi/privacy/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/zh-TW/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/zh-TW/license/360-total-security/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/zh-TW/privacy/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/zh-cn/experience.html
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/zh-cn/license/360-total-security-essential/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/zh-cn/license/360-total-security/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/zh-cn/privacy/
                  Source: 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/zh-tw/experience.html
                  Source: 360hvm64_win10.sys.42.drBinary or memory string: __win32kstub_NtUserRegisterRawInputDevicesmemstr_207fb3e6-3

                  E-Banking Fraud

                  barindex
                  Hooks winsocket function (used for sniffing or altering network traffic)
                  Source: explorer.exeFile created: function: SendInput
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsark_win10.catJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsark64_win10.catJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\hookport_win10.catJump to dropped file

                  Spam, unwanted Advertisements and Ransom Demands

                  barindex
                  Reads the Security eventlog
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                  Reads the System eventlog
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                  Writes many files with high entropy
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeFile created: C:\Users\user\Pictures\360TS_Setup.exe.P2P entropy: 7.9947868314Jump to dropped file
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeFile created: C:\Users\user\Pictures\360TS_Setup.exe (copy) entropy: 7.9947868314Jump to dropped file
                  Source: C:\Users\user\Pictures\360TS_Setup.exeFile created: C:\Program Files (x86)\1721892447_0\360TS_Setup.exe entropy: 7.9947868314Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\lang\vi\SysSweeper.ui.dat entropy: 7.99824293868Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\lang\ru\SysSweeper.ui.dat entropy: 7.99839511623Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\tracesweeper.dat entropy: 7.99894919458Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\patt.enc entropy: 7.9997422106Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\qex.vdb.enc entropy: 7.99954825407Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\dsconz.dat entropy: 7.99037939907Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\dsconz.dat entropy: 7.99016446053Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\deepscan\dsconz.dat entropy: 7.99061886443Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\deepscan\dsconz.dat entropy: 7.99002844356Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\deepscan\dsconz.dat entropy: 7.990304556Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\dsconz.dat entropy: 7.99081120532Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\deepscan\dsconz.dat entropy: 7.99047034542Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\deepscan\dsconz.dat entropy: 7.99143900812Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\3G\LibOui.dat entropy: 7.99230870384Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\LibSDI.dat entropy: 7.99824156826Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\LibSDI.dat entropy: 7.99831702786Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\libsdi.dat entropy: 7.99837092372Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\LibSDI.dat entropy: 7.99845744515Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\LibSDI.dat entropy: 7.99812292776Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\LibSDI.dat entropy: 7.99857629006Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\LibSDI.dat entropy: 7.99844867606Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\LibSDI.dat entropy: 7.99831702786Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\libsdi.dat entropy: 7.9984763848Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\libsdi.dat entropy: 7.99854362173Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\LibSDI.dat entropy: 7.99804599993Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\LibSDI.dat entropy: 7.99825030073Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\LibSDI.dat entropy: 7.9981082256Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\LibSDI.dat entropy: 7.99820874819Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\lsv.dat entropy: 7.99696835381Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\Qshieldz.dat entropy: 7.99968069651Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\safespeedboot.dat entropy: 7.9973663814Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\ssr.dat entropy: 7.99426302456Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\ssr.dat entropy: 7.99365294086Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\ssr.dat entropy: 7.99309973158Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\deepscan\ssr.dat entropy: 7.99453795618Jump to dropped file

                  System Summary

                  barindex
                  Malicious sample detected (through community Yara rule)
                  Source: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\ramengine.dll, type: DROPPEDMatched rule: Gandcrab Payload Author: kevoreilly
                  Yara detected EICAR
                  Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360rp.dll, type: DROPPED
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_004460F0: CreateFileA,DeviceIoControl,CloseHandle,21_2_004460F0
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360Camera64.sys
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360Camera64.sys
                  Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360Camera64.sys
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360AntiHacker64.sys
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360AvFlt.sys
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360netmon.sys
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360Box64.sys
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeCode function: 0_2_00007FFAACCD9DB00_2_00007FFAACCD9DB0
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeCode function: 0_2_00007FFAACCDB16D0_2_00007FFAACCDB16D
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeCode function: 0_2_00007FFAACCD34D30_2_00007FFAACCD34D3
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeCode function: 0_2_00007FFAACCD335E0_2_00007FFAACCD335E
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeCode function: 0_2_00007FFAACCD34180_2_00007FFAACCD3418
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeCode function: 0_2_00007FFAAD630E290_2_00007FFAAD630E29
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0040995021_2_00409950
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0043402921_2_00434029
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_004343A021_2_004343A0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0042842021_2_00428420
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_004684E521_2_004684E5
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0043455021_2_00434550
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0044653021_2_00446530
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0045A84421_2_0045A844
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0044683021_2_00446830
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0042EA6021_2_0042EA60
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00468A2921_2_00468A29
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00434B1021_2_00434B10
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00432B9021_2_00432B90
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0045AD1921_2_0045AD19
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00432EB021_2_00432EB0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00460F4E21_2_00460F4E
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00432FC021_2_00432FC0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0046306921_2_00463069
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0044F00021_2_0044F000
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_004530D021_2_004530D0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0045B0ED21_2_0045B0ED
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0046912121_2_00469121
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0040729021_2_00407290
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_004313A021_2_004313A0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0045B4F921_2_0045B4F9
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0042580021_2_00425800
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0045783A21_2_0045783A
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_004058A021_2_004058A0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0045B91921_2_0045B919
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00433A1021_2_00433A10
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00423C3021_2_00423C30
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00433E5021_2_00433E50
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00467FA121_2_00467FA1
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00469FBE21_2_00469FBE
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeCode function: 42_3_0884F79A42_3_0884F79A
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess token adjusted: Load Driver
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: String function: 004050C0 appears 43 times
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: String function: 00453DCC appears 49 times
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: String function: 04D03C15 appears 36 times
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: String function: 04D03BDF appears 444 times
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: String function: 04D03BA9 appears 78 times
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: String function: 04D03B76 appears 1563 times
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 460 -p 2440 -ip 2440
                  Source: 6Se9cfVvgkgQ1LiWk4azwLiz.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: PNRovpjvuoTBDQWgmW6Dxpeu.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: PQ7InkkMnF4WgBpnrK0fM12d.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: hnKZFCj5oe7DMZMOnuhsEUAF.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: JbCzziprwhxu952EEGGM4kyy.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 7TZg7zlWDNnbBmFYTmmvpQh2.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: p0TVeG7PgzSYUEgCbGq9rvc9.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 3pU7us2lCosxu8OuPe4BpnIe.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: Qhn5Cs4iUiQe1fOLh3QZma5T.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 0lzVim7riCB1upr1FUP8xSQR.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: iaqDCrpk7XgTBT3Gv3tL3MhD.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: nlajzL0nJsjGBoOzsEHar6xN.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: YiBUNoJoPIhAtYOnilMSPvZS.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: eXYG01pvaO43Gh2ID1P8KBeF.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: OwwOgzkPQh7uMioCPDE28dVh.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: tsPDoXjJ5QDVbxpQe7Ldx9O5.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: PT6Mx7KioNvzBAtCL7QX2GXq.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: S3AafgsV3ndWpGK20WkoNgGW.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: U3Oa50HVWGsdPmyCniC9yFFX.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: Qs8gKU4lVOLm6RixkxRfa4V2.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 36dsvh9ycgNnqmR2ByFaAF5L.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: UVfMqDwGoGEvVkVybkeC8QrI.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 8M7DUF3xBSx8QcSLemrdjOdg.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 5HEEZMiEnWqR242MeEoxlGRh.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: yE7noGQXNcOT5zohTTwqK6bF.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 4ZZwfXAuJ072C1VqOfz1A4ih.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: UDhWZlM2m146SXcde4F56BRT.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: vjkQvA9A1258BKNJpE9OFR7r.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: tAqt9uSHmrF7Z3H2xvM1lxwA.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 6HbUFGG6OprNlIY5JlVhXXii.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: nPpyxVDuMw96yZmSf6gQ2TqY.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: Et3mnRfmuPQFakro2oc74eeS.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 6Yd84thjPkhRBN2b6a5H1jnf.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: CUxLCA8x4ghROFTMPdaQB3M5.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 2tcX737WHyo5lwEvmctv51Vv.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: DD12FHVAYroWK47l2n2nUb6f.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: UIgbZOdyaVSQ6RYQSEeprj5d.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 87AZujGvMD0DS3bxBzittT7r.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: fw2TOiWzGo1NrFLSXdW9IHtr.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: vG59IrPYDLqWmCOO9Pfbpgeu.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: pkUUm3iviYyjVuVwVzn44HrC.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: 7FamwTPi2SttiX4DgdTFvBP1.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: Ij1WDhMqibF1B2QU9vGntIlT.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: XlgZgJ2LJW81kHOYIHPmyxJ5.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: cuOUlQ9A7hneJRyyE6akV0sd.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: kqmEb6pkblBuU3ikfPK4qcR5.exe.12.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                  Source: LisectAVT_2403002C_44.exeStatic PE information: No import functions for PE file found
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539479297.00000251001C0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameItutemoJ vs LisectAVT_2403002C_44.exe
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.00000251658A1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNew.exe" vs LisectAVT_2403002C_44.exe
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000000.1228009358.0000025163B9C000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamePayaret.exe0 vs LisectAVT_2403002C_44.exe
                  Source: LisectAVT_2403002C_44.exeBinary or memory string: OriginalFilenamePayaret.exe0 vs LisectAVT_2403002C_44.exe
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDriver loaded: \Registry\Machine\System\CurrentControlSet\Services\BAPIDRV
                  Source: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\ramengine.dll, type: DROPPEDMatched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
                  Source: LisectAVT_2403002C_44.exe, ModeCancellationPending.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                  Source: 360AntiHacker64_win10.sys.42.drBinary string: \Device\Afd
                  Source: 360AntiHacker64_win10.sys.42.drBinary string: \Device\360IPFilter
                  Source: 360AntiHacker64_win10.sys.42.drBinary string: \Device\IP
                  Source: 360AntiHacker64_win10.sys.42.drBinary string: HTTP://PsGetProcessPeb\Device\360Hvm
                  Source: qutmipc_win10.sys.42.drBinary string: \Driver\NDProxy\Driver\AfdSeExportsmspfilejsefilevbefilevbsfilecplfilewshfilewsffileregfilemsifilejsfilehtafilescrfilecomfilescffilepiffilebatfilecmdfilelnkfileexefile.msp.jse.vbe.vbs.cpl.wsh.wsf.reg.msi.js.hta.scr.com.scf.pif.bat.cmd.lnk.exe_Classes\RtlFormatCurrentUserKeyPath\Device\Mup\\Device\LanmanRedirector\24L
                  Source: 360AntiHacker64_win10.sys.42.drBinary string: \Device\360SelfProtection
                  Source: 360boxmain.exe.42.drBinary string: K`XD%machinename%%UserProfile%*\Documents and Settings\*\Local Settings\Temp\**\Documents and Settings\*\Local Settings\Temporary Internet Files\**\Documents and Settings\*\Cookies\**\AppData\Local\Temp\**\AppData\Roaming\Microsoft\Windows\Cookies\*.wmv.rmvb.rm.mpg.mp4.mov.mkv.flv.avi.3gp.wma.ra.mp3.ogg.mka.m4a.ac3.aac.xlsx.xls.pptx.ppt.txt.pdf.docx.doc..CacheSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders360SANDBOX\SHADOW360sandbox\filelist_page.xml::{26EE0668-A00A-44D7-9371-BEB064C98683}IDS_MEDIA_LIST_DESCIDS_DOCUMENT_LIST_DESCIDS_DELETE_PROMPT_MSGPreferred DropEffectIDS_COPY_PRMPT360SandBox\Shadow360SANDBOX\SHADOW\IDS_UPPER_FOLDERIDS_DATE_TIME_FMT%Y-%m-%d %H:%MC:\sxin.dllsxin64.dllSxWrapper.dllWINDOWS\SXIn.dllIDS_CRITICAL_FILE_PROMPT_MSG\Device\FloppyX
                  Source: 360AntiHacker64_win10.sys.42.drBinary string: \Device\Nsi
                  Source: 360FsFlt_old.sys.42.drBinary string: c:\vmagent_new\bin\joblist\689163\src\3\360fsflt_sys_dbgad2_for_i18n\ad\aklrules.cwin32k.sysW32pServiceTableW32pServiceLimit\Device\XBS @I %08x @P %s @I %08x @C %s @P %s @I %08x @C %smsi.dll\SystemRoot\System32\msiexec.exePsGetThreadId-EmbeddingClipboardDataObjectInterfaceMTAClipboardRootDataObjectInterfaceClipboardDataObjectInterfaceObGetObjectType\Sessions\1\Windows\ApiPort\Windows\ApiPortSymbolicLinkValue /update /as /enable /update /as /enable /as\MSASCui.exe -wdenable\MpCmdRun.exeunknown processc:\vmagent_new\bin\joblist\689163\src\3\360fsflt_sys_dbgad2_for_i18n\ad\adrules.c[SendForkProcessMessageToClient]Driver Send Fork Process!!!
                  Source: 360AntiHacker64_win10.sys.42.drBinary string: Version\Device\360AntiHacker
                  Source: 360FsFlt_old.sys.42.drBinary string: \Device\Srv2
                  Source: 360AntiHacker64_win10.sys.42.drBinary string: \Device\360SelfProtectionUSER PUT POST HELOHEAD GET EHLODELETE
                  Source: 360FsFlt_old.sys.42.drBinary string: (S\Device\Mup\\Device\LanmanRedirector\LocalHost.LocalHost127.0.0.124x
                  Source: qutmipc_win10.sys.42.drBinary string: \DosDevices\exploitcap\Device\exploitcap\Device\qutmipc\DosDevices\qutmipcPsGetProcessSessionIdIoQueryFileDosDeviceNamePsGetProcessPebPsGetCurrentProcessSessionIdExReleaseRundownProtectionExAcquireRundownProtection\FileSystem\qutmdrv\FileSystem\Filters\qutmdrvPsGetProcessImageFileNameObGetObjectType\Registry\Machine\System\-Embedding\Device\360SelfProtectionSystem\Device\360HookPortMmCopyVirtualMemoryshell32.dll\REGISTRY\MACHINE\{26CEAE5B-627C-4ed6-9E96-2A2F0E93A13C}\10002\REGISTRY\MACHINE\{26CEAE5B-627C-4ed6-9E96-2A2F0E93A13C}\10001PsReferenceProcessFilePointerSYSTEMunknown processsystem
                  Source: 360AntiHacker64_win10.sys.42.drBinary string: \Device\360NsiFilter
                  Source: 360FsFlt_old.sys.42.drBinary string: \Device\MountPointManager
                  Source: 360hvm64_win10.sys.42.drBinary string: \Device\360Hvm
                  Source: 360AntiHacker64_win10.sys.42.drBinary string: \Device\360TdiFilter
                  Source: 360AntiHacker64_win10.sys.42.drBinary string: 360 AntiHacker Flow Establish%s<c=%d><a=%d><mid=%s><m2=%s><product=ipc><combo=kernel><v=1><b=%s><c=%d>\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\RunOnce\Registry\Machine\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce360safeuninst<a=except_exit><d=%d><e=%04u%02u%02u %02u:%02u:%02u>FwpmFilterDeleteById0FwpsFlowRemoveContext0FwpsFlowAssociateContext0FwpmTransactionAbort0FwpsCalloutUnregisterById0FwpmFilterAdd0FwpmCalloutAdd0FwpsCalloutRegister0FwpmProviderDestroyEnumHandle0FwpmProviderDeleteByKey0FwpmProviderEnum0FwpmProviderCreateEnumHandle0FwpmSubLayerDestroyEnumHandle0FwpmSubLayerDeleteByKey0FwpmSubLayerEnum0FwpmSubLayerCreateEnumHandle0FwpmCalloutDestroyEnumHandle0FwpmCalloutDeleteByKey0FwpmCalloutEnum0FwpmCalloutCreateEnumHandle0FwpmFilterDeleteByKey0FwpmFilterEnum0FwpmFilterDestroyEnumHandle0FwpmFilterCreateEnumHandle0FwpmTransactionCommit0FwpmTransactionBegin0FwpmEngineClose0FwpmEngineOpen0FwpmFreeMemory0FWPKCLNT.sysWskReleaseProviderNPIWskCaptureProviderNPIWskDeregisterWskRegisterNETIO.sys\Device\UdpTransportAddress316b91494d610d5492487f01RSDS
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447668964.0000000002561000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1831668320.00000000025BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447668964.0000000002561000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1831668320.00000000025BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447668964.0000000002561000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1831668320.00000000025BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447668964.0000000002561000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1831668320.00000000025BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *.sln
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447668964.0000000002561000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1831668320.00000000025BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MSBuild MyApp.csproj /t:Clean
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447668964.0000000002561000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1831668320.00000000025BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /ignoreprojectextensions:.sln
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.00000251003B3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447668964.0000000002561000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1831668320.00000000025BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.
                  Source: classification engineClassification label: mal100.rans.bank.troj.expl.evad.winEXE@134/1278@0/31
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00428300 _memset,__wsplitpath,GetDiskFreeSpaceExW,21_2_00428300
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0044AAD0 GetTickCount,CreateToolhelp32Snapshot,_memset,Process32FirstW,_memset,Process32NextW,CloseHandle,21_2_0044AAD0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00409950 FindResourceW,LoadResource,SizeofResource,FreeResource,_memset,LockResource,FreeResource,21_2_00409950
                  Source: C:\Users\user\Pictures\360TS_Setup.exeFile created: C:\Program Files (x86)\1721892447_0
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\9fMPr9bjofOW56waLjTgg4fo.exeJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:6028:64:WilError_03
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 336
                  Source: C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 4132
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:4268:64:WilError_03
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1928
                  Source: C:\Users\user\Pictures\360TS_Setup.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 4872
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1888:120:WilError_03
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess336
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 8140
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 1548
                  Source: C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 1928
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:744:64:WilError_03
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeMutant created: NULL
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeMutant created: \Sessions\1\BaseNamedObjects\Local\Q360SafeI18NInstaller
                  Source: C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 6228
                  Source: C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 6844
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:4864:64:WilError_03
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4132
                  Source: C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 5172
                  Source: C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exeMutant created: \Sessions\1\BaseNamedObjects\Q360SafeInstallerMutex
                  Source: C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exeMutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 1252
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1340:120:WilError_03
                  Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2440
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:4312:64:WilError_03
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6228
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6844
                  Source: C:\Windows\System32\svchost.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\ff64d64a-c1e8-4eeb-b88a-ffbd0c566fbe
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aWJAM7LmGVjrqyGFkBX76m6y.bat" "
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: /runonce21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: /runonce21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: open21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: pkg21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: \GG21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: show21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: clientid21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: IDS_TITLE21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: chs21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: IDS_TITLE21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: IDS_TITLE21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: IDS_TITLE21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: ini_url_default21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: IDS_QUIT21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: IDS_URL_ERROR21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: IDS_TITLE21_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: /tswin1021_2_004036F0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCommand line argument: /tsewin1021_2_004036F0
                  Source: LisectAVT_2403002C_44.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: LisectAVT_2403002C_44.exeStatic file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: LisectAVT_2403002C_44.exeReversingLabs: Detection: 50%
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeFile read: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeJump to behavior
                  Source: unknownProcess created: C:\Users\user\Desktop\LisectAVT_2403002C_44.exe "C:\Users\user\Desktop\LisectAVT_2403002C_44.exe"
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
                  Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 460 -p 2440 -ip 2440
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2440 -s 3156
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe "C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe" /s
                  Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exe "C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exe" /s
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 336 -ip 336
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 984
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exe "C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exe" /s
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1928 -ip 1928
                  Source: C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 976
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exe "C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exe" /s
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6228 -ip 6228
                  Source: C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6228 -s 976
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exe "C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exe" /s
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6844 -ip 6844
                  Source: C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 984
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aWJAM7LmGVjrqyGFkBX76m6y.bat" "
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exe "C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exe" /s
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeProcess created: C:\Users\user\Pictures\360TS_Setup.exe "C:\Users\user\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4132 -ip 4132
                  Source: C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 972
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe "C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe" /s
                  Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jLw9YTEqZHJtGfgAlmf6QvQQ.bat" "
                  Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Pictures\360TS_Setup.exeProcess created: C:\Program Files (x86)\1721892447_0\360TS_Setup.exe "C:\Program Files (x86)\1721892447_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exe "C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exe" /s
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"Jump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe "C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exe "C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exe "C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exe "C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exe "C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exe "C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe "C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exe "C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 460 -p 2440 -ip 2440
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2440 -s 3156
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 336 -ip 336
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 984
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1928 -ip 1928
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 976
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6228 -ip 6228
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6228 -s 976
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6844 -ip 6844
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 984
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4132 -ip 4132
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 972
                  Source: C:\Windows\System32\WerFault.exeProcess created: unknown unknown
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeProcess created: C:\Users\user\Pictures\360TS_Setup.exe "C:\Users\user\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
                  Source: C:\Users\user\Pictures\360TS_Setup.exeProcess created: C:\Program Files (x86)\1721892447_0\360TS_Setup.exe "C:\Program Files (x86)\1721892447_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
                  Source: C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess created: unknown unknown
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: dwrite.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: msvcp140_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: windows.applicationmodel.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: twinapi.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: moshost.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mapsbtsvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mosstorage.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mapconfiguration.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: storsvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: fltlib.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: bcd.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wer.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: storageusage.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: aphostservice.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: networkhelper.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userdataplatformhelperutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: syncutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mccspal.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: vaultcli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dmcfgutils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dmcmnutils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dmxmlhelputils.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: inproclogger.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: windows.networking.connectivity.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: synccontroller.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: pimstore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: aphostclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: accountaccessor.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dsclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: systemeventsbrokerclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userdatalanguageutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mccsengineshared.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cemapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userdatatypehelperutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: phoneutil.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: usosvc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: updatepolicy.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: taskschd.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: upshared.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: usocoreps.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: usoapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: w32time.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: logoncli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: vmictimeprovider.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: edputil.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: appresolver.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: oleacc.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: netapi32.dllJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: wkscli.dllJump to behavior
                  Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: wlidsvc.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: clipc.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msxml6.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: wtsapi32.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: winsta.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: gamestreamingext.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: msauserext.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: tbs.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptnet.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: cryptngc.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: ncryptprov.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: elscore.dll
                  Source: C:\Windows\System32\svchost.exeSection loaded: elstrans.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: apphelp.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: msimg32.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: cryptbase.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: profapi.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: secur32.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: userenv.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: authz.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: winnsi.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: iphlpapi.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: cabinet.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: devrtl.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: windowscodecs.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: sfc_os.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: rasman.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: rasapi32.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: dhcpcsvc.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: dnsapi.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: rasadhlp.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: rtutils.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: dhcpcsvc6.dll
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeSection loaded: cryptsp.dll
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeFile written: C:\Users\user\AppData\Local\Temp\!@t65A5.tmp.dir\setup.ini
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\UpgradesJump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot
                  Source: LisectAVT_2403002C_44.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: LisectAVT_2403002C_44.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: LisectAVT_2403002C_44.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                  Source: Binary string: C:\Users\user\Desktop\LisectAVT_2403002C_44.PDB source: LisectAVT_2403002C_44.exe, 00000000.00000002.1538127572.000000EFC50F3000.00000004.00000010.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\mscorlib.pdbH source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.0000025100240000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\621001\out\Release\360boxmain.pdb source: 360boxmain.exe.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\372449\out\Release\SysCleanerUI.pdb source: SysCleanerUI.exe.42.dr
                  Source: Binary string: pC:\Users\user\Desktop\LisectAVT_2403002C_44.PDB source: LisectAVT_2403002C_44.exe, 00000000.00000002.1538127572.000000EFC50F3000.00000004.00000010.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\806392\out\Release\Installer.pdb source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1500985189.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1499687327.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1501833439.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1502015815.0000000004D81000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmp
                  Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.0000025100240000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.00000251003B3000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: c:\vmagent_new\bin\joblist\689163\src\3\360fsflt_sys_dbgad2_for_i18n\filter\objfre_win7_amd64\amd64\360FsFlt.pdb source: 360FsFlt_old.sys.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\55974\out\Release\360GuardBase.pdb source: 360GuardBase.dll.42.dr
                  Source: Binary string: \??\C:\Users\user\Desktop\LisectAVT_2403002C_44.PDB# source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.0000025100240000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\451438\out\Release\zh-CN\CloudSec3.dll.pdb source: cloudsec3.dll.locale11.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\500965\out\Release\MenuEx.pdb source: MenuEx.dll.42.dr
                  Source: Binary string: D:\Project\SafeGuardIntl\branches\SafeInt_V6.2\i18n\I18N\DsRes64\Release\zh-CN\DsRes64.pdb source: DsRes64.dll10.42.dr
                  Source: Binary string: LisectAVT_2403002C_44.PDB source: LisectAVT_2403002C_44.exe, 00000000.00000002.1538127572.000000EFC50F3000.00000004.00000010.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\435521\out\Release\360DeskAna.pdb source: 360DeskAna.exe.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\329925\out\Release\LiveUpdate360.pdb source: LiveUpdate360.exe.42.dr
                  Source: Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.00000251003B3000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: c:\vmagent_new\bin\joblist\320146\src\q\qutmipc_obtracer_sys\hookportregchangedriver\objfre_wxp_x86\i386\qutmipc.pdb source: qutmipc_win10.sys.42.dr
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.00000251003B3000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: mscorlib.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.00000251003B3000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\451442\out\Release\pt\DsRes.pdb source: DsRes.dll5.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\396552\out\Release\BootLeakFixer.pdb source: BootLeakFixer.tpi.42.dr
                  Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbolean) source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.0000025100240000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447668964.0000000002561000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1831668320.00000000025BB000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: c:\vmagent_new\bin\joblist\606617\src\3\360antihacker_driver\src\objfre_win7_amd64\amd64\360AntiHacker64.pdb source: 360AntiHacker64_win10.sys.42.dr
                  Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.0000025100240000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\258920\out\Release\ru\UrlSettings.dll.pdb source: UrlSettings.dll.locale8.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb0pH| source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428070059.0000000000471000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495710361.0000000000471000.00000002.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554016071.0000000000471000.00000002.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572473034.0000000000471000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615615416.0000000000471000.00000002.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1630769787.0000000000471000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689360314.0000000000471000.00000002.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668954536.0000000000471000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741171716.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729446292.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786575405.0000000000471000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.dr
                  Source: Binary string: \??\C:\Windows\dll\mscorlib.pdbN source: LisectAVT_2403002C_44.exe, 00000000.00000002.1539643258.00000251003B3000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\vmagent_new\bin\joblist\329925\out\Release\LiveUpdate360.pdbtK source: LiveUpdate360.exe.42.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428070059.0000000000471000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495710361.0000000000471000.00000002.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554016071.0000000000471000.00000002.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572473034.0000000000471000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615615416.0000000000471000.00000002.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1630769787.0000000000471000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689360314.0000000000471000.00000002.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668954536.0000000000471000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741171716.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729446292.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786575405.0000000000471000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.dr
                  Source: Binary string: C:\vmagent_new\bin\joblist\815457\out\Release\en\filemgr.dll.pdb source: filemgr.dll.locale7.42.dr
                  Source: LisectAVT_2403002C_44.exeStatic PE information: 0xC245A31E [Thu Apr 13 21:14:06 2073 UTC]
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_004643D4 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,21_2_004643D4
                  Source: LisectAVT_2403002C_44.exeStatic PE information: real checksum: 0x65472 should be: 0x6547b
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeCode function: 0_2_00007FFAACCD752B push ebx; iretd 0_2_00007FFAACCD756A
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeCode function: 0_2_00007FFAACCD7963 push ebx; retf 0_2_00007FFAACCD796A
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeCode function: 0_2_00007FFAACCE0B7C pushfd ; iretd 0_2_00007FFAACCE0BB4
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeCode function: 0_2_00007FFAAD63026B push esp; retf 4810h0_2_00007FFAAD630312
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CCCC44 push esp; retf 18_3_04CCCC49
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CCCC44 push esp; retf 18_3_04CCCC49
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFB69E push ecx; ret 18_3_04CFB71B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFB69E push ecx; ret 18_3_04CFB71B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFB69E push ecx; ret 18_3_04CFB71B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFB69E push ecx; ret 18_3_04CFB71B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC615 push edx; ret 18_3_04CFC616
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC615 push edx; ret 18_3_04CFC616
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC615 push edx; ret 18_3_04CFC616
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC615 push edx; ret 18_3_04CFC616
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC846 push 01A437B9h; ret 18_3_04CFC84B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC846 push 01A437B9h; ret 18_3_04CFC84B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC846 push 01A437B9h; ret 18_3_04CFC84B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC846 push 01A437B9h; ret 18_3_04CFC84B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CCCC44 push esp; retf 18_3_04CCCC49
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CCCC44 push esp; retf 18_3_04CCCC49
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFB69E push ecx; ret 18_3_04CFB71B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFB69E push ecx; ret 18_3_04CFB71B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFB69E push ecx; ret 18_3_04CFB71B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFB69E push ecx; ret 18_3_04CFB71B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC615 push edx; ret 18_3_04CFC616
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC615 push edx; ret 18_3_04CFC616
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC615 push edx; ret 18_3_04CFC616
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC615 push edx; ret 18_3_04CFC616
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC846 push 01A437B9h; ret 18_3_04CFC84B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC846 push 01A437B9h; ret 18_3_04CFC84B
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeCode function: 18_3_04CFC846 push 01A437B9h; ret 18_3_04CFC84B

                  Persistence and Installation Behavior

                  barindex
                  Contains functionality to infect the boot sector
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d21_2_0044E2B0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_0044E440
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d21_2_0044DEF0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_00445FF9
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: _malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_00445F90
                  Creates a FSFilter Anti-Virus service
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry value created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\360AvFlt\Instances\360SDInstance Altitude
                  Installs new ROOT certificates
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072 Blob
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419 Blob
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247 Blob
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5 Blob
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85 Blob
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25 Blob
                  Sample is not signed and drops a device driver
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360Camera64.sys
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360AntiHacker64.sys
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360AvFlt.sys
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360netmon.sys
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Windows\system32\drivers\360Box64.sys
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\7TZg7zlWDNnbBmFYTmmvpQh2.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\AVE\360KPBase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsark64_old.sysJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\y2xlfwgZYtLHYanrRQ8JSWVl.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\UIgbZOdyaVSQ6RYQSEeprj5d.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360P2SP.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\commonbase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsark64.sysJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\JbCzziprwhxu952EEGGM4kyy.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360base64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\TEngine.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360NetBase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\svcMonitor.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\somkernl.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\PromoUtil.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\Utils\360ScreenCapture.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\Utils\360ScreenCapture.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\AntiAdwa.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\SxWrapper.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360netbase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk64_win10.sysJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\36dsvh9ycgNnqmR2ByFaAF5L.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\fw2TOiWzGo1NrFLSXdW9IHtr.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\deepscan\DsRes.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DownloadMgr.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360Util64.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\iaqDCrpk7XgTBT3Gv3tL3MhD.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\kqmEb6pkblBuU3ikfPK4qcR5.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\qutmipc_win10.sysJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\tOjl1xMHwPniA98wveB6sp5S.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360Quarant.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\modules\KB931125-rootsupd.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\spsafe64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\VWallet.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\AVE\360KP.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\Utils\360searchlite.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\2tcX737WHyo5lwEvmctv51Vv.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LargeFileFinder.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SimpleIME.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\OwwOgzkPQh7uMioCPDE28dVh.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\chrome\360webshield.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SiteUIProxy.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\ScriptExecute.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\Ij1WDhMqibF1B2QU9vGntIlT.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WDRecord.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Uninstall.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHWatchdog.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\360netctrl.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\DrvUtility.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SpeedUp.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHToasts.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\EaInstHelper.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DriverUpdater.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360GuardBase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360SkinView.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\AVCheck.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\QdK9qeDGACGo9zbnCRy3mj3u.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\7z.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Camera64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360compro.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\eXYG01pvaO43Gh2ID1P8KBeF.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360scovec64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\yhregd.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk.dllJump to dropped file
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeFile created: C:\Users\user\AppData\Local\Temp\{72EED8BA-9242-4de1-9063-4C81F09A6B03}.tmp\360P2SP.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\CleanHelper64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\FeedBack.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\scanproxy.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\Qhn5Cs4iUiQe1fOLh3QZma5T.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exeFile created: C:\Users\user\AppData\Local\Temp\{BF2BE5E6-902C-4720-A988-382B5CE16F33}.tmp\360P2SP.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\SDPlugin\AdPopWnd.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\CUxLCA8x4ghROFTMPdaQB3M5.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\crashreport64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WDSafeDown.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\wdui2.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\3G\3GIdentify.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\appd.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\menuex64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\appdext.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360elam.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\SysSweeper.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHAccount.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\4ZZwfXAuJ072C1VqOfz1A4ih.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\sites.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360net.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SomAdvUtilsWrap.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\SXIn64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLProxy64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\nICxaxPOAPjSog9aqauyJ12l.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\UVfMqDwGoGEvVkVybkeC8QrI.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\sweeper\360FastFind.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WDPayPro.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\ReuFdz5VW3kSYWFmIhNeNe2A.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360FsFlt_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\urlproc.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\PopWndTracker.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360rp.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360procmon.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\wdui3.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SelfProtection_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\6Se9cfVvgkgQ1LiWk4azwLiz.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\WhiteCache.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360NetBase64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLCore.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\hookport.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\PQ7InkkMnF4WgBpnrK0fM12d.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box64_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\SXIn.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\qutmipc.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Base64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeFile created: C:\Users\user\Pictures\360TS_Setup.exe.P2PJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Users\user\Pictures\360TS_Setup.exeFile created: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\50\360netmon_50.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\atTmWMexfjDNHZsj4eS3cFWa.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\szkqjw57V0nOs0wQUlJUUsLd.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Dumpuper.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DuplicateFile.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\EfiMon.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WscReg.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\3pU7us2lCosxu8OuPe4BpnIe.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\nlajzL0nJsjGBoOzsEHar6xN.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360avflt64_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LeakFixHelper64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\DumpUper.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\PatchUp.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360FsFlt_win10.sysJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\tsPDoXjJ5QDVbxpQe7Ldx9O5.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLLauncher.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\Qs8gKU4lVOLm6RixkxRfa4V2.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\CrashReport.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\stx.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360WifiProtect.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\N4T8qP0zIsmhNbok9EeYkn9g.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHSafeScanner.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHSafeTray.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\rmt.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SelfProtection.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360Opt.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360Util.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Camera.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\360FastFind.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\sysfilerepS.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\DesktopPlus64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qutmdrv_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\QVM\360AQVM.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360zipc.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DrvInst64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Util64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360TsLiveUpd.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360DeskAna64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\swverify64.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\S3AafgsV3ndWpGK20WkoNgGW.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Common.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DSFScan.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHActiveDefense.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\crashreport.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ToolBox.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360TSCommon.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\yE7noGQXNcOT5zohTTwqK6bF.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\cuOUlQ9A7hneJRyyE6akV0sd.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\NetworkMon.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\AVE\AVEI.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\AntiTrack64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\C5Kjr9aaz6hDS52NkOqq8y55.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Base.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\tAqt9uSHmrF7Z3H2xvM1lxwA.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Verify.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\wfp\360netmon_x64_wfp.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\DesktopPlus.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\hookport_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\chromesafe64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360hipsPopWnd.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SomAdvUtils.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsmain.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360QuarantPlugin.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\Cloudsec3.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SafeCamera.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360Tray.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\TrashClean.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360tscommon.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\PopTip.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360SoftMgrS.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360Connect.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\CheckSM.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\0CtLUUWAoHtcou0zdP0CzCUj.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SoftMgrLite.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\x64\360netmon_x64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Repair.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\UvKXEQwl3D7YytLyF1DjkOvH.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\scanstub.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\AntiCe.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360AV.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SysCleanerUI.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\Antiadwa.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\UDhWZlM2m146SXcde4F56BRT.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\cloudcom2.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\HomeRouterMgr.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeFile created: C:\Users\user\Pictures\360TS_Setup.exe (copy)Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SysCleaner.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\Antiadwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Sites64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Util.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\ModuleUpdate.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\p0TVeG7PgzSYUEgCbGq9rvc9.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\6Yd84thjPkhRBN2b6a5H1jnf.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SPTool.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPI.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DrvmgrCore.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\SomProxy.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt_win10.sysJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\hnKZFCj5oe7DMZMOnuhsEUAF.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\X64For32Lib.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LiveUpdate360.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qutmdrv.sysJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\8M7DUF3xBSx8QcSLemrdjOdg.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\scanbase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360base.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\pkUUm3iviYyjVuVwVzn44HrC.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLLauncher64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\CombineExt.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360ShellPro.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\EaInstHelper64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360realpro.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360avflt64.sysJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\nPpyxVDuMw96yZmSf6gQ2TqY.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Conf.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV64_old.sysJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\PNRovpjvuoTBDQWgmW6Dxpeu.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360elam64.sysJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\0lzVim7riCB1upr1FUP8xSQR.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sites.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\AntiTrack.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHFileSmasher.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\BrowseringProtection.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\MedalWall.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\wfp\360netmon_wfp.sysJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\BYMTdmumqdQRWdqfOhAEZ4m7.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\deepscan\DsRes.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLHelper64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\QVM\360QVM.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360DeskAna.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\DailyNews.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\SelfProtectAPI2.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\dlproc.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\XlgZgJ2LJW81kHOYIHPmyxJ5.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm64_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\AVE\AVEngine.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\60\360netmon_60.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\swverify32.dllJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\6HbUFGG6OprNlIY5JlVhXXii.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\YiBUNoJoPIhAtYOnilMSPvZS.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\360GameIdentify.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\sites64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\Et3mnRfmuPQFakro2oc74eeS.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\U3Oa50HVWGsdPmyCniC9yFFX.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\sysoptm.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360NetUL.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\spsafe.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\PowerSaver.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360calaInt.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360TSCommon64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\chromesafe.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360bsmon.tpiJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\aniaYFsW0PlkrlJ2YcSQ1uDn.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\CheckSM.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\UDiskScanEngine.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\menuex.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\cef\cefutil.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Local\PT6Mx7KioNvzBAtCL7QX2GXq.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\CQhCltHttpW.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\TraceClean.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360FsFlt.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\PopWndLog.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\Tracehelper.exeJump to dropped file
                  Source: C:\Users\user\Pictures\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\1721892447_00000000_base\360base.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHSafeMain.exeJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Camera_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Camera64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360scovec.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360safemonpro.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\CondrvFix.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\sbx.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\Utils\360searchlite.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\menuex.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360tscommon.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360tscommon64.dll (copy)Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360DeskAna64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\DumpUper.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\crashreport64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360Util.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\Utils\360ScreenCapture.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360Util64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360base.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360netbase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360base64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\menuex64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\sites.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\sweeper\360FastFind.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\Utils\360searchlite.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\crashreport.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\360DeskAna.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\360TotalSecurity\DesktopPlus\sites64.dllJump to dropped file
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeFile created: C:\Users\user\Pictures\360TS_Setup.exe.P2PJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\Antiadwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\Antiadwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360AV.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360bsmon.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360Connect.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SafeCamera.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360safemonpro.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360UDisk.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\AdPopBlocker.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\BootLeakFixer.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\DiagScanTips.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\DsTpi.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\FilePrivacy.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\gamemode.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\netmon.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\qutmvd.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\Safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\Safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\Safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\Safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\Safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\Safemon64.dll.localeJump to dropped file

                  Boot Survival

                  barindex
                  Contains functionality to infect the boot sector
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d21_2_0044E2B0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_0044E440
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d21_2_0044DEF0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_00445FF9
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: _malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d21_2_00445F90
                  Drops script or batch files to the startup folder
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7pCdXa3VPPixXDeiDERuIUe.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vYH2GBgutbYFV7StmqrF392h.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qbbFZA8KUyY320BJKYkkQtYc.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ftfiPBwwMqNVVJZnn7PZ42oW.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pQK5jhKLuMPM67O36bjRAtlp.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sM0pd9IgVzsfjezNSbt2hR8c.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pZxmHLS4YUZppdDnCbM54TVk.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pWYyEAMmGvRdSQiFkMbPsyKA.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SlrtBJJYXextedHC5RRXtqjD.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CCM79EJDWoOaU28j3sM2Lwwo.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sHRAIShzlUtV2Ej2KkHQUTd8.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FEvbcWeHlUCQ6wJiJ7Ty3YrK.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ipxaLwijnNCaFbKHMVglZ1Gv.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ByP6u97qxNfZ81fsarYDva02.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uHnfZZZd2SrSzViwEQo8A2Zo.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TmtCXHeFfNXnhKof0nPqXoXk.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FdEAiaBtdTb53bxGipyuLeHz.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IcfW3XsxniNtxPUg3uti8t4y.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mc7dNCewwnFtbMeKarYV0nyt.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jqBjaEhJsWFWAYj7GXVx0xrr.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yrFSwTlmj7ddrNdTdahgfOKX.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZsZOFxiSwOteG3HE4X7AykQ3.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PmY9HZ56zikoreGGsiW4JI8R.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5wRhfRBk6MCDZeJ0qEjmfyeG.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fYK2NbmAGi9Pg4SG2aLRfRmI.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h9wamzhzzhwACA9Mtcf07wz6.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dFBhuG7x7cuyTo0UEY1FLx3F.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jThuXZ4voJcJhbCjFEaBHzHv.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ssx35u7TOA2nPAp0L1L3IKsf.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0hV0gAK22xvEtgvyKQ5yOs5n.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CvIKtqidl2guUPBHjxVUFQtv.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZaKd5MYji3kAyTfvu5KO5wp5.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vnAGf0bQ9J14q0sRMygGsW8l.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FVQRuTSzJTtHAXSQWwQCLvZY.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jLw9YTEqZHJtGfgAlmf6QvQQ.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lKmPsTV4YA7CYpmS0qsQItFO.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kGFe11FaCHj8Cq6LEsxAKO9Q.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sksCZf6BD8bmyHJVUY7BoElf.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aWJAM7LmGVjrqyGFkBX76m6y.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kV5jXmTcsMiETlF8iRGxyKFt.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3zFuzRgWu8nsIZVxdNWJ2gln.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0Sw8mVAoATaNcrREXaxGRBLH.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n16Ul2pmsPZpymsRFsDrzjOF.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ezskEwZPmKODwzVBTltwetRT.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l2UL1f1VQQ9TgewgTJp5cafq.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tjY51tWJaahZmfQU8rSeUhVQ.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lf37LKjOy1F8yH9htI5go57b.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2dZXHu4mBuz0k7K0hcQByrTC.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YmyYC9ZIZqInZy9lU02lfnot.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xvy9mj0sqpawGMMbF7MUoN4G.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ca6YBXJj4xO3yMydtaSpZbg2.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sBSPGXFVGr9XmZ4KnrA6cgvt.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jDlV6JCqkaaMXdj2ilRXIwiB.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QaR7JQApk4Gm5USjcAqonvDp.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BEyHr3bfAnMOq3irAN86EVFJ.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M1OuzBuysJJ6kE8KobZHawCS.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7GHKGgWXYpBu6ujvkCqrAqEk.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\X4AeTFkWxvvr0UutH23jyajK.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HVygIk5xltJ26qO7i4Ttg3dw.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\p4mun4rwQavBk6vXf7mLPsDM.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AYU4aYQGSewAU8NRdpVSLYs1.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9zZvqHeESRzOOvzVhqrk9jbq.batJump to dropped file
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dFBhuG7x7cuyTo0UEY1FLx3F.batJump to behavior
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\360AntiHacker
                  Source: C:\Windows\System32\svchost.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\ConfigJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dFBhuG7x7cuyTo0UEY1FLx3F.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jThuXZ4voJcJhbCjFEaBHzHv.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vnAGf0bQ9J14q0sRMygGsW8l.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jLw9YTEqZHJtGfgAlmf6QvQQ.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lKmPsTV4YA7CYpmS0qsQItFO.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kGFe11FaCHj8Cq6LEsxAKO9Q.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sksCZf6BD8bmyHJVUY7BoElf.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aWJAM7LmGVjrqyGFkBX76m6y.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kV5jXmTcsMiETlF8iRGxyKFt.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0Sw8mVAoATaNcrREXaxGRBLH.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n16Ul2pmsPZpymsRFsDrzjOF.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ezskEwZPmKODwzVBTltwetRT.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l2UL1f1VQQ9TgewgTJp5cafq.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PmY9HZ56zikoreGGsiW4JI8R.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fYK2NbmAGi9Pg4SG2aLRfRmI.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h9wamzhzzhwACA9Mtcf07wz6.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0hV0gAK22xvEtgvyKQ5yOs5n.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CvIKtqidl2guUPBHjxVUFQtv.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZaKd5MYji3kAyTfvu5KO5wp5.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FVQRuTSzJTtHAXSQWwQCLvZY.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3zFuzRgWu8nsIZVxdNWJ2gln.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ssx35u7TOA2nPAp0L1L3IKsf.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZsZOFxiSwOteG3HE4X7AykQ3.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5wRhfRBk6MCDZeJ0qEjmfyeG.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vYH2GBgutbYFV7StmqrF392h.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qbbFZA8KUyY320BJKYkkQtYc.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pQK5jhKLuMPM67O36bjRAtlp.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ftfiPBwwMqNVVJZnn7PZ42oW.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SlrtBJJYXextedHC5RRXtqjD.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pWYyEAMmGvRdSQiFkMbPsyKA.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pZxmHLS4YUZppdDnCbM54TVk.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sM0pd9IgVzsfjezNSbt2hR8c.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ipxaLwijnNCaFbKHMVglZ1Gv.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FEvbcWeHlUCQ6wJiJ7Ty3YrK.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sHRAIShzlUtV2Ej2KkHQUTd8.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CCM79EJDWoOaU28j3sM2Lwwo.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TmtCXHeFfNXnhKof0nPqXoXk.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uHnfZZZd2SrSzViwEQo8A2Zo.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ByP6u97qxNfZ81fsarYDva02.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jqBjaEhJsWFWAYj7GXVx0xrr.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mc7dNCewwnFtbMeKarYV0nyt.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IcfW3XsxniNtxPUg3uti8t4y.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FdEAiaBtdTb53bxGipyuLeHz.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yrFSwTlmj7ddrNdTdahgfOKX.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lf37LKjOy1F8yH9htI5go57b.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tjY51tWJaahZmfQU8rSeUhVQ.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2dZXHu4mBuz0k7K0hcQByrTC.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xvy9mj0sqpawGMMbF7MUoN4G.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YmyYC9ZIZqInZy9lU02lfnot.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sBSPGXFVGr9XmZ4KnrA6cgvt.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ca6YBXJj4xO3yMydtaSpZbg2.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QaR7JQApk4Gm5USjcAqonvDp.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jDlV6JCqkaaMXdj2ilRXIwiB.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BEyHr3bfAnMOq3irAN86EVFJ.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HVygIk5xltJ26qO7i4Ttg3dw.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\X4AeTFkWxvvr0UutH23jyajK.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7GHKGgWXYpBu6ujvkCqrAqEk.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M1OuzBuysJJ6kE8KobZHawCS.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AYU4aYQGSewAU8NRdpVSLYs1.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\p4mun4rwQavBk6vXf7mLPsDM.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9zZvqHeESRzOOvzVhqrk9jbq.batJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7pCdXa3VPPixXDeiDERuIUe.batJump to behavior
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360 Security Center
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360 Security Center\360 Total Security
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\360 Security Center
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\360 Security Center\360 Total Security
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360 Security Center\360 Total Security\360 Total Security.lnk
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\360 Security Center\360 Total Security\360 Total Security.lnk
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360 Security Center\360 Total Security\Sandbox.lnk
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\360 Security Center\360 Total Security\Sandbox.lnk
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360 Security Center\360 Total Security\Patch Up.lnk
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\360 Security Center\360 Total Security\Patch Up.lnk
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run QHSafeTray
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run QHSafeTray

                  Hooking and other Techniques for Hiding and Protection

                  barindex
                  Modifies the prolog of user mode functions (user mode inline hooks)
                  Source: explorer.exeUser mode code has changed: module: user32.dll function: SendInput new code: 0xE9 0x9B 0xBB 0xBB 0xB6 0x64
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 BlobJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX

                  Malware Analysis System Evasion

                  barindex
                  Yara detected AntiVM3
                  Source: Yara matchFile source: Process Memory Space: LisectAVT_2403002C_44.exe PID: 2440, type: MEMORYSTR
                  Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\qex.dll, type: DROPPED
                  Query firmware table information (likely to detect VMs)
                  Source: C:\Windows\System32\svchost.exeSystem information queried: FirmwareTableInformationJump to behavior
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeSystem information queried: FirmwareTableInformation
                  Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeMemory allocated: 25163EC0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeMemory allocated: 2517D8A0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeMemory allocated: 2E80000 memory reserve | memory write watchJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeMemory allocated: 3080000 memory reserve | memory write watchJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeMemory allocated: 5080000 memory reserve | memory write watchJump to behavior
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001 name: DriverDesc
                  Source: C:\Windows\System32\svchost.exeFile opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 600000Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599875Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599765Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599656Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599547Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599423Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599297Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599187Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599069Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598968Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598859Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598731Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598625Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598515Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598406Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598295Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598187Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598076Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597953Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597840Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597609Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597500Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597390Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597281Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597172Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597047Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596937Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596828Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596719Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596594Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596484Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596375Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596265Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596156Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596046Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595937Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595826Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595718Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595605Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595499Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595355Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595225Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595109Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595000Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 300000Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594890Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594781Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594672Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594560Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594453Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594343Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594234Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594125Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeWindow / User API: threadDelayed 2526Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeWindow / User API: threadDelayed 7288Jump to behavior
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\AVE\360KPBase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsark64_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360P2SP.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\commonbase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsark64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360netcfg.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\360base64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\libzdtp.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\TEngine.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360AdvToolExecutor.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360NetBase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\svcMonitor.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\somkernl.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\PromoUtil.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\Utils\360ScreenCapture.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\Utils\360ScreenCapture.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\AntiAdwa.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\libzdtp64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\SxWrapper.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\360netbase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\deepscan\DsRes64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\RemoteTrashInterface.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\FilePrivacy.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DownloadMgr.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\360Util64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\qutmipc_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\deepscan.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360Quarant.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\modules\KB931125-rootsupd.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360PrivacyGuard.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\spsafe64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360UDisk.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\VWallet.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\AVE\360KP.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\Utils\360searchlite.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360AntiTrack.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LargeFileFinder.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SimpleIME.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18ngi.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\chrome\360webshield.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SiteUIProxy.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\ScriptExecute.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Uninstall.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WDRecord.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360boxld64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHWatchdog.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\DrvUtility.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\360netctrl.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SpeedUp.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHToasts.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\qutmvd.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\EaInstHelper.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DriverUpdater.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360SkinView.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360GuardBase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\AVCheck.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\EfiProc.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\7z.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\I18N64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\netmon.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Camera64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360compro.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360scovec64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\yhregd.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netmstart.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk.dllJump to dropped file
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{72EED8BA-9242-4de1-9063-4C81F09A6B03}.tmp\360P2SP.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\CleanHelper64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\FeedBack.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\Safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\scanproxy.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\DsRes64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{BF2BE5E6-902C-4720-A988-382B5CE16F33}.tmp\360P2SP.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\360tscommon64.dll (copy)Jump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\SDPlugin\AdPopWnd.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\DsRes64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\crashreport64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WDSafeDown.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\PopSoftEng.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\wdui2.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\3G\3GIdentify.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\appd.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\appdext.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\menuex64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\DsTpi.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsSysRepair.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360elam.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\SysSweeper.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHAccount.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\MiniUI.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360net.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\BootLeakFixer.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SomAdvUtilsWrap.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLProxy64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\SXIn64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\sweeper\360FastFind.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\Safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\deepscan\DsRes64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\ramengine.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\deepscan\DsRes64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WDPayPro.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360FsFlt_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\disproc.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\PopWndTracker.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\urlproc.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360InstantSetup.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360rp.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360procmon.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SelfProtection_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\wdui3.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360DeskAna.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\WhiteCache.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360NetBase64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\hookport.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLCore.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\FsrMgr.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box64_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\SXIn.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\qutmipc.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\FastAnimation.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Base64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\iNetSafe64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\50\360netmon_50.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Dumpuper.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\gamemode.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DuplicateFile.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\dynlenv.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\EfiMon.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WscReg.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\CrashReport64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LeakFixHelper64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360avflt64_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\DumpUper.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\PatchUp.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\DsRes64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\deepscan\DsRes64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360FsFlt_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\modules\360PatchMgr.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLLauncher.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\AdPopBlocker.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\CrashReport.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\ImAVEng.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\stx.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\UrlSettings.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360WifiProtect.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360boxmain.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\FileMgr.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHSafeScanner.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHSafeTray.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\rmt.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\cef\2623\libcef.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV_old.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360Opt.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SelfProtection.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\360Util.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\360FastFind.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Camera.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\sysfilerepS.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\DesktopPlus64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qutmdrv_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\QVM\360AQVM.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\lockkrnl.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360zipc.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\jcloudscan.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LiveUpd360.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DrvInst64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\Safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Util64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360TsLiveUpd.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\Netgm.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\NetworkMonUI.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\dynlbase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\360DeskAna64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\swverify64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Common.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DSFScan.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\MenuEx64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\heavygate.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\I18N.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHActiveDefense.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\Safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\crashreport.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ToolBox.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360TSCommon.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\NetworkMon.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360DeskAna64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\AVE\AVEI.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\AntiTrack64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Base.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Verify.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\wfp\360netmon_x64_wfp.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\DesktopPlus.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\PHPEX.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\hookport_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\chromesafe64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\deepscan\DsRes64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360hipsPopWnd.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\PDown.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SomAdvUtils.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\deepscan\DsRes64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\yhregd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\modules\360EvtMgr.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsmain.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360QuarantPlugin.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Central.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\Cloudsec3.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SafeCamera.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360Tray.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LeakFixHelper64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\TrashClean.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\360tscommon.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\PopTip.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360SoftMgrS.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360Connect.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\spsafe64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\modules\360PatchMgr64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\CheckSM.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SoftMgrLite.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\x64\360netmon_x64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Repair.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\scanstub.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360AV.tpiJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\AntiCe.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360boxld.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SysCleanerUI.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\Sxin64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\deepscan\DsRes64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\Antiadwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\cloudcom2.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\UDiskScanEngine.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\HomeRouterMgr.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\deepscan\DsRes64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\chrome\360webshield.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\360SPTool.exe.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\appd.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SysCleaner.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker64_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\Antiadwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Sites64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\Safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Util.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\ModuleUpdate.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SPTool.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DrvmgrCore.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPI.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt_win10.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\SomProxy.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\X64For32Lib.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LiveUpdate360.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qutmdrv.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\scanbase.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\deepscan\cloudsec3.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\AntiAdwa.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\ProgramData\360TotalSecurity\DesktopPlus\360base.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\Sxin.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\webprotection_firefox\plugins\nptswp.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLLauncher64.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\SelfProtectAPI2.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\filemgr.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\spsafe.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\Safemon64.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\CombineExt.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\safemon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\NetDefender.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360ShellPro.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHVer.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\EaInstHelper64.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360realpro.exeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360avflt64.sysJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\360procmon.dll.localeJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Conf.dllJump to dropped file
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV64_old.sysJump to dropped file
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_21-46916
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_21-47447
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeAPI coverage: 5.3 %
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeRegistry key enumerated: More than 132 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                  Source: C:\Windows\System32\svchost.exe TID: 720Thread sleep time: -30000s >= -30000sJump to behavior
                  Source: C:\Windows\System32\svchost.exe TID: 720Thread sleep time: -30000s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep count: 37 > 30Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -34126476536362649s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -600000s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7820Thread sleep count: 2526 > 30Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -599875s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -599765s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -599656s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7820Thread sleep count: 7288 > 30Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -599547s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -599423s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -599297s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -599187s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -599069s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -598968s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -598859s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -598731s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -598625s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -598515s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -598406s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -598295s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -598187s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -598076s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -597953s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -597840s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -597609s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -597500s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -597390s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -597281s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -597172s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -597047s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -596937s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -596828s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -596719s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -596594s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -596484s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -596375s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -596265s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -596156s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -596046s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -595937s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -595826s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -595718s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -595605s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -595499s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -595355s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -595225s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -595109s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -595000s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7648Thread sleep time: -300000s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -594890s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -594781s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -594672s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -594560s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -594453s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -594343s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -594234s >= -30000sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792Thread sleep time: -594125s >= -30000sJump to behavior
                  Source: C:\Windows\System32\svchost.exe TID: 7896Thread sleep time: -30000s >= -30000s
                  Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\Windows\System32 FullSizeInformationJump to behavior
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeFile Volume queried: C:\Users\user\Desktop FullSizeInformation
                  Source: C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exeFile Volume queried: C:\Users\user\Desktop FullSizeInformation
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile Volume queried: C:\ FullSizeInformation
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00429BF0 FindClose,lstrlenW,lstrlenW,lstrlenW,lstrcpyW,FindFirstFileW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,21_2_00429BF0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00428190 _memset,GetLogicalDriveStringsW,_memset,QueryDosDeviceW,21_2_00428190
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 600000Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599875Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599765Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599656Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599547Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599423Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599297Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599187Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 599069Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598968Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598859Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598731Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598625Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598515Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598406Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598295Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598187Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 598076Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597953Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597840Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597609Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597500Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597390Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597281Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597172Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 597047Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596937Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596828Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596719Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596594Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596484Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596375Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596265Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596156Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 596046Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595937Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595826Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595718Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595605Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595499Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595355Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595225Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595109Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 595000Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 300000Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594890Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594781Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594672Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594560Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594453Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594343Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594234Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 594125Jump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\WER\
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LisectAVT_240300_30926f56636b977de717efc0a33cc4ae6873153_8dafb6ee_37d64a93-2585-4cac-aad3-8809d659c484\
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
                  Source: C:\Windows\SysWOW64\WerFault.exeFile opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_r0raHcCIH1k2YsFl_8cc313ba89e65827eb2b854a8ee3edf9cb9d41d6_6c9ad7ec_5564019a-2eb2-4a14-af3e-d6e5dd0bf216\
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                  Source: YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447405023.00000000025BC000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447668964.00000000025BC000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1447547012.00000000025BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual disk 2.0 6000c298128b8c02a71a2474aeb5f3dc$
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000SCSI\CdRomNECVMWarVMware_SATA_CD001.00SCSI\CdRomNECVMWarVMware_SATA_CD00SCSI\CdRomNECVMWarSCSI\NECVMWarVMware_SATA_CD001NECVMWarVMware_SATA_CD001GenCdRom
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware20,1
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
                  Source: LisectAVT_2403002C_44.exe, 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
                  Source: svchost.exe, 00000008.00000003.1399474319.00000245F1010000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000SCSI\DiskVMware__Virtual_disk____2.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____2VMware__Virtual_disk____2GenDisk
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeAPI call chain: ExitProcess graph end nodegraph_21-47449
                  Source: C:\Windows\System32\svchost.exeProcess information queried: ProcessInformation
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\AVLib.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr7.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\DataDriv.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\ptype.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr9.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Program Files (x86)\360\Total Security\filemon\AVLib.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt.dll
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr1.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr6.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Program Files (x86)\360\Total Security\filemon\360AvFlt64_win10.sys
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr5.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr4.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\regmon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr8.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\filemon.dat
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeFile opened: C:\Users\user~1\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\regmon.dat
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeProcess queried: DebugPort
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeProcess queried: DebugPort
                  Source: C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exeProcess queried: DebugPort
                  Source: C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exeProcess queried: DebugPort
                  Source: C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exeProcess queried: DebugPort
                  Source: C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exeProcess queried: DebugPort
                  Source: C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exeProcess queried: DebugPort
                  Source: C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exeProcess queried: DebugPort
                  Source: C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exeProcess queried: DebugPort
                  Source: C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exeProcess queried: DebugPort
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00458457 __getptd,LdrInitializeThunk,__amsg_exit,__lock,InterlockedDecrement,InterlockedIncrement,21_2_00458457
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_004500E9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,21_2_004500E9
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00447E70 GetCurrentThreadId,GetProcessHeap,OpenThread,OpenThread,GetLastError,GetProcessHeap,HeapFree,OutputDebugStringW,CloseHandle,21_2_00447E70
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_004643D4 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,21_2_004643D4
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00447B00 GetCurrentProcessId,CreateMutexW,GetLastError,WaitForSingleObject,GetProcessHeap,HeapAlloc,__CxxThrowException@8,__CxxThrowException@8,ReleaseMutex,CloseHandle,21_2_00447B00
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess token adjusted: Debug
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess token adjusted: Debug
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess token adjusted: Debug
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_004500E9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,21_2_004500E9
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0046080C SetUnhandledExceptionFilter,21_2_0046080C
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00452E9E __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,21_2_00452E9E
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0044D324 _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,21_2_0044D324
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0044FBBA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,21_2_0044FBBA
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeMemory allocated: page read and write | page guardJump to behavior

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Allocates memory in foreign processes
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and writeJump to behavior
                  Injects a PE file into a foreign processes
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5AJump to behavior
                  Sample uses process hollowing technique
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeSection unmapped: unknown base address: 400000Jump to behavior
                  Writes to foreign memory regions
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 404000Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 406000Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: E08008Jump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"Jump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe "C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exe "C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exe "C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exe "C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exe "C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exe "C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe "C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exe "C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exe" /sJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 460 -p 2440 -ip 2440
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2440 -s 3156
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 336 -ip 336
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 984
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1928 -ip 1928
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 976
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6228 -ip 6228
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6228 -s 976
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6844 -ip 6844
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 984
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4132 -ip 4132
                  Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 972
                  Source: C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exeProcess created: C:\Users\user\Pictures\360TS_Setup.exe "C:\Users\user\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
                  Source: C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeProcess created: unknown unknown
                  Source: C:\Users\user\Pictures\360TS_Setup.exeProcess created: C:\Program Files (x86)\1721892447_0\360TS_Setup.exe "c:\program files (x86)\1721892447_0\360ts_setup.exe" /c:ww.marketator.cpi20230405 /pmode:2 /s /promo:eyjib290dgltzsi6ijcilcjtzwrhbci6ijcilcjuzxdzijoimcisim9wzxjhijoinyisim9wzxjhx2lucyi6ijailcjwb3b1cci6ijcilcjyzw1pbmrlcii6ijcilcj1cgdyywrlx25vdyi6ijaifqo= /tsinstall
                  Source: C:\Users\user\Pictures\360TS_Setup.exeProcess created: C:\Program Files (x86)\1721892447_0\360TS_Setup.exe "c:\program files (x86)\1721892447_0\360ts_setup.exe" /c:ww.marketator.cpi20230405 /pmode:2 /s /promo:eyjib290dgltzsi6ijcilcjtzwrhbci6ijcilcjuzxdzijoimcisim9wzxjhijoinyisim9wzxjhx2lucyi6ijailcjwb3b1cci6ijcilcjyzw1pbmrlcii6ijcilcj1cgdyywrlx25vdyi6ijaifqo= /tsinstall
                  Source: 360FsFlt_old.sys.42.drBinary or memory string: Shell_TrayWndDV2ControlHostEdit
                  Source: 360DeskAna.exe.42.drBinary or memory string: QueryFullProcessImageNameW"%s" "%s"IsWow64ProcessWow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection%programfiles%%commonprogramfiles% (x86)lspscan\syswow64\\system32\\windows\syswow64\Program managerProgmanExplorerExt.dllLoadLibraryWKernel32buffer too largeROOT\CIMV2CreateWin32_ProcessCommandLineReturnValueProcessId..\safemon\BrowserFix.dllShowLockHomePageDlg..\360Base.dll/se1"" /se2/sex1/sex2ieoptionuninstalluiqueryicon360DTAievolumelockhomepage3264lspfix/func=netmoncheckT
                  Source: 360FsFlt_old.sys.42.drBinary or memory string: R#32770ButtonEditComboBoxEx32QHSafeTray.exewdpaypro.exeComboBoxEx32ReBarWindow32SysListView32FolderViewCabinetWClassProgmanWorkerWExploreWClassToolbarWindow32csrss.exe
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0044EA60 cpuid 21_2_0044EA60
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,21_2_0045A4EF
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,21_2_0045A617
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: GetLocaleInfoA,GetLocaleInfoA,GetACP,21_2_0045A0FA
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,21_2_0045A211
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,21_2_0045A2A9
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,21_2_0045A31D
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,21_2_0045A5B0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,21_2_0045A653
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,21_2_0046473F
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,21_2_004549E1
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: GetLocaleInfoA,21_2_00462BAC
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,21_2_004593E0
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,21_2_0045D825
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,21_2_00459A4E
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,21_2_00459CA6
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,21_2_00465D67
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,21_2_00465D33
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,21_2_00465EA6
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: GetLocaleInfoA,21_2_00455FBD
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Users\user\Desktop\LisectAVT_2403002C_44.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AdoNetDiag.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\alink.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrcompression.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\compatjit.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CORPerfMonExt.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Culture.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfdll.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FileTracker.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtilLib.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ISymWrapper.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Activities.Build.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Activities.Build.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Conversion.v4.0.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v4.0.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Engine.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Tasks.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v4.0.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Utilities.v4.0.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.CSharp.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Data.Entity.Build.Tasks.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Internal.Tasks.Dataflow.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Internal.Tasks.Dataflow\v4.0_4.0.0.0__b77a5c561934e089\Microsoft.Internal.Tasks.Dataflow.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.JScript.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Transactions.Bridge.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Transactions.Bridge.Dtc.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Compatibility.Data.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Compatibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualC.Dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualC.STLCLR.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\v4.0_2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.ApplicationServer.Applications\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Windows.ApplicationServer.Applications.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordacwks.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscordbi.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpe.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\netstandard.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentasklauncher.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\PerfCounter.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\peverify.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SbsNclPerf.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelEvents.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelInstallRC.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceMonikerSupport.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMDiagnostics.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SOS.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sysglobl.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\sysglobl.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.Core.Presentation.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Core.Presentation.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.DurableInstancing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn\v4.0_4.0.0.0__b77a5c561934e089\System.AddIn.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AppContext\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.AppContext.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.Concurrent.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections.Concurrent\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Collections.Concurrent.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Collections.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.NonGeneric.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections.NonGeneric\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Collections.NonGeneric.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.Specialized.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections.Specialized\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Collections.Specialized.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.Annotations.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Annotations\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ComponentModel.Annotations.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.Composition.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.DataAnnotations.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ComponentModel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.EventBasedAsync.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.EventBasedAsync\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ComponentModel.EventBasedAsync.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ComponentModel.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.TypeConverter.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.TypeConverter\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ComponentModel.TypeConverter.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Configuration.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Configuration.Install.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Console.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Console\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Console.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Common\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Data.Common.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Entity.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Entity.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Linq.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.OracleClient.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.Client.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Client.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Services.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Deployment.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Device.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Contracts\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Contracts.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Debug.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Debug\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Debug.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Process\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Process.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.StackTrace\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.StackTrace.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.TextWriterTraceListener.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.TextWriterTraceListener\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.TextWriterTraceListener.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Tools.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Tools\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Tools.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.TraceSource.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.TraceSource\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.TraceSource.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Tracing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Tracing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Tracing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Dynamic.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Dynamic.Runtime.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic.Runtime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.Runtime.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.EnterpriseServices.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.EnterpriseServices.Thunk.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.EnterpriseServices.Wrapper.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Globalization.Calendars.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization.Calendars\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Globalization.Calendars.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Globalization.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Globalization.Extensions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IdentityModel.Selectors.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IdentityModel.Services.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Services\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.Services.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.FileSystem.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.ZipFile\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.ZipFile.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.FileSystem\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.FileSystem.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.DriveInfo.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.FileSystem.DriveInfo\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.FileSystem.DriveInfo.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.FileSystem.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.FileSystem.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.Watcher.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.FileSystem.Watcher\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.FileSystem.Watcher.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.IsolatedStorage.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.IsolatedStorage\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.IsolatedStorage.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Log.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.MemoryMappedFiles.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Pipes.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.UnmanagedMemoryStream\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.IO.UnmanagedMemoryStream.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.Expressions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq.Parallel\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Linq.Parallel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq.Queryable\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Linq.Queryable.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Management.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Management.Instrumentation.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089\System.Management.Instrumentation.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Messaging.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.Rtc.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http.Rtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.Rtc.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.WebRequest.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.NetworkInformation.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.NetworkInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.NetworkInformation.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Ping.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Ping\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Ping.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Requests\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Requests.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Security.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Security.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Sockets.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Sockets\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Sockets.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebHeaderCollection.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.WebHeaderCollection\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.WebHeaderCollection.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebSockets.Client.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.WebSockets.Client\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.WebSockets.Client.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebSockets.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.WebSockets\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.WebSockets.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Numerics.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Numerics.Vectors.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics.Vectors\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Numerics.Vectors.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ObjectModel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ObjectModel\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ObjectModel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.context.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Context\v4.0_4.0.0.0__b77a5c561934e089\System.Reflection.context.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Reflection.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.ILGeneration.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.Lightweight.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Emit.Lightweight\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Reflection.Emit.Lightweight.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Extensions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Reflection.Extensions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Reflection.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.Reader.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Resources.Reader\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Resources.Reader.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.ResourceManager.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.Writer.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Resources.Writer\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Resources.Writer.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Caching.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.CompilerServices.VisualC.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.CompilerServices.VisualC\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.CompilerServices.VisualC.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.DurableInstancing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Runtime.DurableInstancing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Extensions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Handles.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Handles\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Handles.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.WindowsRuntime.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.WindowsRuntime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.WindowsRuntime.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Numerics.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Numerics\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Numerics.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Remoting.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Formatters.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Json.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Json\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Json.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Xml.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Xml\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Xml.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.WindowsRuntime.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.WindowsRuntime\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.WindowsRuntime.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.WindowsRuntime.UI.Xaml.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.WindowsRuntime.UI.Xaml\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.WindowsRuntime.UI.Xaml.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Claims.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Claims\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Claims.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Algorithms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Algorithms\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.Algorithms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Csp.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Csp\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.Csp.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Encoding.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Encoding\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.Encoding.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.X509Certificates.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.X509Certificates\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.X509Certificates.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.SecureString\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.SecureString.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Activation.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activation.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Activities.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Activities.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Channels.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Channels.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Discovery.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Duplex.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Duplex\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.Duplex.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.Http.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.NetTcp\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.NetTcp.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.Primitives.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Routing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Routing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Security.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.Security.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.ServiceMoniker40.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.ServiceMoniker40\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.ServiceMoniker40.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.WasHosting\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Web.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Text.Encoding\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Text.Encoding.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Text.Encoding.Extensions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Text.Encoding.Extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Text.Encoding.Extensions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Overlapped\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.Overlapped.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Tasks.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Tasks.Parallel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Tasks.Parallel\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.Tasks.Parallel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Thread.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Thread\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.Thread.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.ThreadPool.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.ThreadPool\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.ThreadPool.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Timer.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.Timer\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Threading.Timer.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ValueTuple.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Abstractions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Abstractions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Abstractions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.ApplicationServices.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.ApplicationServices.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DataVisualization.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DataVisualization.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DataVisualization.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DynamicData.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.DynamicData.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Entity.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Entity.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity\v4.0_4.0.0.0__b77a5c561934e089\System.Web.Entity.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Extensions.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Extensions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Mobile.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Mobile\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Routing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Routing\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Routing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Windows.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.DataVisualization.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.Design.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.ComponentModel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.Runtime.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.WorkflowServices.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.WorkflowServices\v4.0_4.0.0.0__31bf3856ad364e35\System.WorkflowServices.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\System.Xaml.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.Hosting.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\System.Xaml.Hosting.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.XML.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.Linq.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.ReaderWriter\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.ReaderWriter.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.Serialization.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XDocument.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XmlDocument.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XmlDocument\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.XmlDocument.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XmlSerializer.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XmlSerializer\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.XmlSerializer.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XPath.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XPath\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.XPath.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XPath.XDocument.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XPath.XDocument\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Xml.XPath.XDocument.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\TLBREF.DLL VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\webengine.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WMINet_Utils.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WorkflowServiceHostPerformanceCounters.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\XamlBuildTask.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XamlBuildTask\v4.0_4.0.0.0__31bf3856ad364e35\XamlBuildTask.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\XsdBuildTask.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XsdBuildTask\v4.0_4.0.0.0__31bf3856ad364e35\XsdBuildTask.dll VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformationJump to behavior
                  Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformationJump to behavior
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformationJump to behavior
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_00450247 GetSystemTimeAsFileTime,__aulldiv,21_2_00450247
                  Source: C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exeCode function: 21_2_0044AA70 _memset,GetVersionExW,21_2_0044AA70
                  Source: C:\Users\user\Desktop\LisectAVT_2403002C_44.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                  Lowering of HIPS / PFW / Operating System Security Settings

                  barindex
                  Changes security center settings (notifications, updates, antivirus, firewall)
                  Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{FFDC234A-CE9B-08F9-406B-F876951CE066} GUIDJump to behavior
                  Source: SysCleanerUI.exe.42.drBinary or memory string: D@B@Kernel32.dllAddDllDirectoryCreateObject360Base.dllPathSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exe
                  Source: qutmipc_win10.sys.42.drBinary or memory string: kxetray.exe
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, qutmipc_win10.sys.42.drBinary or memory string: 360safe.exe
                  Source: BootLeakFixer.tpi.42.drBinary or memory string: System32\ntoskrnl.exeSysNative\ntoskrnl.exeRtlGetVersionopenSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exe
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exeBinary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
                  Source: r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E0000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697528678.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Paths\360safe.exe
                  Source: qutmipc_win10.sys.42.drBinary or memory string: ksafetray.exe
                  Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 BlobJump to behavior
                  Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
                  Source: C:\Windows\System32\svchost.exeWMI Queries: AntiVirusProduct.instanceGuid=&quot;{FFDC234A-CE9B-08F9-406B-F876951CE066}&quot;
                  Source: C:\Windows\System32\svchost.exeWMI Queries: AntiVirusProduct.instanceGuid=&quot;{FFDC234A-CE9B-08F9-406B-F876951CE066}&quot;
                  Source: C:\Windows\System32\svchost.exeWMI Queries: AntiVirusProduct.instanceGuid=&quot;{FFDC234A-CE9B-08F9-406B-F876951CE066}&quot;
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeWMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : Select * from AntiVirusProduct
                  Source: C:\Program Files (x86)\1721892447_0\360TS_Setup.exeWMI Queries: IWbemServices::ExecQuery - root\securitycenter : Select * from AntiVirusProduct
                  Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\appd.dll, type: DROPPED

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information11
                  Scripting                  		Valid Accounts1
                  Windows Management Instrumentation                  		11
                  Scripting                  		2
                  LSASS Driver                  		111
                  Disable or Modify Tools                  		1
                  Network Sniffing                  		1
                  System Time Discovery                  		Remote Services11
                  Archive Collected Data                  		1
                  Encrypted Channel                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault Accounts2
                  Native API                  		2
                  LSASS Driver                  		1
                  DLL Side-Loading                  		11
                  Deobfuscate/Decode Files or Information                  		11
                  Credential API Hooking                  		5
                  File and Directory Discovery                  		Remote Desktop Protocol11
                  Credential API Hooking                  		Junk DataExfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain Accounts1
                  Shared Modules                  		1
                  DLL Side-Loading                  		3
                  Windows Service                  		2
                  Obfuscated Files or Information                  		11
                  Input Capture                  		1
                  Network Sniffing                  		SMB/Windows Admin Shares11
                  Input Capture                  		SteganographyAutomated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal Accounts12
                  Command and Scripting Interpreter                  		3
                  Windows Service                  		412
                  Process Injection                  		1
                  Install Root Certificate                  		NTDS58
                  System Information Discovery                  		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchd21
                  Registry Run Keys / Startup Folder                  		21
                  Registry Run Keys / Startup Folder                  		1
                  Timestomp                  		LSA Secrets1
                  Query Registry                  		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled Task1
                  Bootkit                  		RC Scripts1
                  DLL Side-Loading                  		Cached Domain Credentials291
                  Security Software Discovery                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                  Rootkit                  		DCSync171
                  Virtualization/Sandbox Evasion                  		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job32
                  Masquerading                  		Proc Filesystem13
                  Process Discovery                  		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                  Modify Registry                  		/etc/passwd and /etc/shadow1
                  Application Window Discovery                  		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                  IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron171
                  Virtualization/Sandbox Evasion                  		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                  Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd412
                  Process Injection                  		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                  Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task1
                  Bootkit                  		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 signatures2 2 Behavior Graph ID: 1481333 Sample: LisectAVT_2403002C_44.exe Startdate: 25/07/2024 Architecture: WINDOWS Score: 100 119 Malicious sample detected (through community Yara rule) 2->119 121 Antivirus / Scanner detection for submitted sample 2->121 123 Multi AV Scanner detection for submitted file 2->123 125 10 other signatures 2->125 9 LisectAVT_2403002C_44.exe 2 2->9         started        12 svchost.exe 5 2->12         started        14 svchost.exe 2 2->14         started        16 12 other processes 2->16 process3 dnsIp4 135 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 9->135 137 Writes to foreign memory regions 9->137 139 Allocates memory in foreign processes 9->139 145 4 other signatures 9->145 19 MSBuild.exe 15 189 9->19         started        24 WerFault.exe 9->24         started        141 Changes security center settings (notifications, updates, antivirus, firewall) 12->141 143 Query firmware table information (likely to detect VMs) 14->143 93 20.101.57.9 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 16->93 95 40.126.31.67 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 16->95 97 3 other IPs or domains 16->97 26 WerFault.exe 16->26         started        28 WerFault.exe 16->28         started        30 WerFault.exe 16->30         started        32 5 other processes 16->32 signatures5 process6 dnsIp7 105 186.145.236.93 TelmexColombiaSACO Colombia 19->105 107 190.224.203.37 TelecomArgentinaSAAR Argentina 19->107 111 8 other IPs or domains 19->111 73 C:\Users\...\r0raHcCIH1k2YsFlLn2OIQyk.exe, PE32 19->73 dropped 75 C:\Users\...\YBwX8KjTjRCKU7PVUt7ohrmo.exe, PE32 19->75 dropped 77 C:\Users\...\yrFSwTlmj7ddrNdTdahgfOKX.bat, ASCII 19->77 dropped 79 120 other files (61 malicious) 19->79 dropped 131 Drops script or batch files to the startup folder 19->131 133 Creates HTML files with .exe extension (expired dropper behavior) 19->133 34 YBwX8KjTjRCKU7PVUt7ohrmo.exe 19->34         started        39 r0raHcCIH1k2YsFlLn2OIQyk.exe 19->39         started        41 7FamwTPi2SttiX4DgdTFvBP1.exe 19->41         started        43 5 other processes 19->43 109 20.42.73.29 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 24->109 file8 signatures9 process10 dnsIp11 99 18.66.102.108 MIT-GATEWAYSUS United States 34->99 101 18.66.102.115 MIT-GATEWAYSUS United States 34->101 103 10 other IPs or domains 34->103 65 C:\Users\user\Pictures\360TS_Setup.exe.P2P, PE32 34->65 dropped 67 C:\Users\user\...\360TS_Setup.exe (copy), PE32 34->67 dropped 69 C:\Users\user\AppData\Local\...\360P2SP.dll, PE32 34->69 dropped 127 Writes many files with high entropy 34->127 45 360TS_Setup.exe 34->45         started        129 Contains functionality to infect the boot sector 39->129 49 WerFault.exe 39->49         started        51 WerFault.exe 41->51         started        71 C:\Users\user\AppData\Local\...\360P2SP.dll, PE32 43->71 dropped 54 WerFault.exe 43->54         started        56 WerFault.exe 43->56         started        58 WerFault.exe 43->58         started        file12 signatures13 process14 dnsIp15 81 C:\Program Files (x86)\...\360TS_Setup.exe, PE32 45->81 dropped 83 C:\Users\user\AppData\Local\...\360base.dll, PE32 45->83 dropped 147 Writes many files with high entropy 45->147 60 360TS_Setup.exe 45->60         started        113 13.89.179.12 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 51->113 file16 signatures17 process18 dnsIp19 115 82.145.213.41 NO-OPERANO United Kingdom 60->115 117 82.145.215.156 NO-OPERANO United Kingdom 60->117 85 C:\Users\user\AppData\Local\...\360rp.dll, PE32 60->85 dropped 87 C:\Users\user\AppData\Local\Temp\...\qex.dll, PE32 60->87 dropped 89 C:\Users\user\AppData\...\tracesweeper.dat, data 60->89 dropped 91 645 other files (34 malicious) 60->91 dropped 149 Query firmware table information (likely to detect VMs) 60->149 151 Installs new ROOT certificates 60->151 153 Sample is not signed and drops a device driver 60->153 155 Creates a FSFilter Anti-Virus service 60->155 file20 signatures21

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  LisectAVT_2403002C_44.exe50%ReversingLabsByteCode-MSIL.Trojan.Jalapeno
                  LisectAVT_2403002C_44.exe100%AviraTR/Redcap.apttc
                  LisectAVT_2403002C_44.exe100%Joe Sandbox ML

                  Dropped Files

                  SourceDetectionScannerLabelLink
                  C:\Program Files (x86)\1721892447_0\360TS_Setup.exe5%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\360DeskAna.exe0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\360DeskAna64.exe0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\360Util.dll0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\360Util64.dll0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\360base.dll0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\360base64.dll0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\360netbase.dll0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\360tscommon.dll0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\360tscommon64.dll (copy)0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus.exe0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus64.exe0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\DumpUper.exe0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\Utils\360ScreenCapture.exe0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\Utils\360searchlite.exe0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\crashreport.dll0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\crashreport64.dll0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\menuex.dll4%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\menuex64.dll0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\sites.dll0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\sites64.dll0%ReversingLabs
                  C:\ProgramData\360TotalSecurity\DesktopPlus\sweeper\360FastFind.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\0lzVim7riCB1upr1FUP8xSQR.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\2tcX737WHyo5lwEvmctv51Vv.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\36dsvh9ycgNnqmR2ByFaAF5L.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\3pU7us2lCosxu8OuPe4BpnIe.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\4ZZwfXAuJ072C1VqOfz1A4ih.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\6Se9cfVvgkgQ1LiWk4azwLiz.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\7TZg7zlWDNnbBmFYTmmvpQh2.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\BYMTdmumqdQRWdqfOhAEZ4m7.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\C5Kjr9aaz6hDS52NkOqq8y55.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\CUxLCA8x4ghROFTMPdaQB3M5.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\Et3mnRfmuPQFakro2oc74eeS.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\Ij1WDhMqibF1B2QU9vGntIlT.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\N4T8qP0zIsmhNbok9EeYkn9g.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\OwwOgzkPQh7uMioCPDE28dVh.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\PT6Mx7KioNvzBAtCL7QX2GXq.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\Qs8gKU4lVOLm6RixkxRfa4V2.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\1721892447_00000000_base\360base.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Base.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Base64.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Central.exe0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Common.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Conf.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360DeskAna.exe0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360DeskAna64.exe0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360NetBase.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360NetBase64.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360NetUL.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360P2SP.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360ShellPro.exe3%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360SkinView.exe0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360TSCommon.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360TSCommon64.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360TsLiveUpd.exe5%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Util.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Util64.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Verify.dll3%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360net.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\3G\3GIdentify.dll3%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\AntiAdwa.dll3%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\AntiCe.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\BrowseringProtection.exe0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\CombineExt.dll3%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\CrashReport.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\CrashReport64.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\DailyNews.exe0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Dumpuper.exe0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\EfiMon.sys0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\EfiProc.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\FastAnimation.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\FeedBack.exe4%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\HomeRouterMgr.exe0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\I18N.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\I18N64.dll0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LargeFileFinder.exe0%ReversingLabs
                  C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LeakFixHelper.dll0%ReversingLabs

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  ⊘No Antivirus matches

                  Domains and IPs

                  Contacted Domains

                  ⊘No contacted domains info

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://www.360totalsecurity.com/en/privacy.htmlivYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                    https://www.360totalsecurity.com/zh-cn/privacy/360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpfalse
                      http://www.360totalsecurity.com/en/license.htmlyWYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446133157.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1448687205.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                        http://www.360totalsecurity.com/en/privacy.htmlJ/5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834407043.00000000022CE000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834617239.00000000022D0000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834847695.00000000022DC000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1839826468.00000000022DF000.00000004.00000020.00020000.00000000.sdmpfalse
                          http://www.360totalsecurity.com/en/privacy.htmlin87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpfalse
                            http://www.360totalsecurity.com/en/privacy.htmlivQ5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                              http://www.360totalsecurity.com/en/privacy.html0%%r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1574034706.00000000006E5000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1632310558.00000000007F5000.00000004.00000020.00020000.00000000.sdmpfalse
                                http://www.360totalsecurity.com/en/license.htmlmexYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                                  http://www.360totalsecurity.com/en/license.htmlys5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                    http://Passport.NET/tbAsvchost.exe, 00000010.00000003.1448409308.0000015C50776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpfalse
                                      http://www.360totalsecurity.com/en/privacy.htmlpe-YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                                        http://www.360totalsecurity.com/en/privacy.htmll&87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633932242.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627205903.00000000022AD000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627632367.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                          https://www.360totalsecurity.com/tr/privacy/360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                            http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabY5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                              http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabbDD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577967137.000000000224E000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571583298.000000000224D000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571219705.0000000002241000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1571920792.000000000224E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                https://www.360totalsecurity.com/zh-cn/license/360-total-security-essential/360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  http://www.360totalsecurity.com/en/privacy.htmlimYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    https://dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000003.00000002.1366216352.000002C2D383F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364950065.000002C2D385A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366735784.000002C2D3863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe360YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428097824.0000000000487000.00000008.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495741557.0000000000487000.00000008.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554060682.0000000000487000.00000008.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572589859.0000000000488000.00000008.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615728423.0000000000487000.00000008.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1631033297.0000000000488000.00000008.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668986779.0000000000487000.00000008.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689485723.0000000000488000.00000008.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741271820.0000000000488000.00000008.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729488267.0000000000487000.00000008.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786649072.0000000000487000.00000008.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.dr, 360GuardBase.dll.42.drfalse
                                                        http://www.360totalsecurity.com/en/license.html7H5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          https://www.360totalsecurity.com/de/license/360-total-security/360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            http://www.360totalsecurity.com/en/license.htmlz.5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834407043.00000000022CE000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834617239.00000000022D0000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834847695.00000000022DC000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1839826468.00000000022DF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              http://down.360safe.com/setupbeta.exer0raHcCIH1k2YsFlLn2OIQyk.exefalse
                                                                http://www.360totalsecurity.com/en/privacy.html&X7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  http://s.360safe.com/safei18n/query_env.htm?%s=%sr0raHcCIH1k2YsFlLn2OIQyk.exefalse
                                                                    http://www.360totalsecurity.com/en/privacy.htmlJ&(987AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633932242.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627205903.00000000022AD000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627632367.00000000022AE000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      http://s.360totalsecurity.com/safei18n/ins.htm?mid=%s&ver=%s&lan=%s&os=%s&ch=%s&sch=%s&ue=%sMainDlg7YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498433469.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498956493.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1497138389.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmpfalse
                                                                        http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabSE.caYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          http://www.360totalsecurity.comIDS_LOAD_P2SP_ERROR/tswin10/tsewin10IDS_UPDATE_QUESTIONIDS_UPDATE_WARYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000000.1428070059.0000000000471000.00000002.00000001.01000000.0000000D.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000000.1495710361.0000000000471000.00000002.00000001.01000000.00000012.sdmp, r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000000.1554016071.0000000000471000.00000002.00000001.01000000.00000013.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1572473034.0000000000471000.00000002.00000001.01000000.00000013.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000000.1615615416.0000000000471000.00000002.00000001.01000000.00000015.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1630769787.0000000000471000.00000002.00000001.01000000.00000015.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1689360314.0000000000471000.00000002.00000001.01000000.00000016.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000000.1668954536.0000000000471000.00000002.00000001.01000000.00000016.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1741171716.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000000.1729446292.0000000000471000.00000002.00000001.01000000.00000017.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000000.1786575405.0000000000471000.00000002.00000001.01000000.00000019.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drfalse
                                                                            http://www.360totalsecurity.com/zh-tw/license.htmlewsvG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697739807.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              http://www.360totalsecurity.com/zh-tw/license.htmlcab9r0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  http://www.360totalsecurity.com/en/privacy.htmlrej5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    http://s.360safe.com/safei18n/ins_err.htm?privQ5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      http://s.360safe.com/safei18n/ins_err.htm?ngYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        https://dynamic.tsvchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364687308.000002C2D385E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          https://t0.ssl.akSsvchost.exe, 00000003.00000003.1365072003.000002C2D3832000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            https://www.360totalsecurity.com/vi/privacy/360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              http://www.360totalsecurity.com/en/license.htmlUVYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446133157.0000000002389000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  http://schemas.xmlsoap.org/ws/2004/09/policywPsvchost.exe, 00000010.00000003.1552419745.0000015C50766000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    https://www.360totalsecurity.com/de/privacy/.$360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      http://www.360totalsecurity.com/zh-cn/license.htmlra=vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697739807.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmp, vjkQvA9A1258BKNJpE9OFR7r.exe.12.drfalse
                                                                                                          https://chrome.google.com/webstore/detail/360-internet-protection/glcimepnljoholdmjchkloafkggfoijhhtYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498433469.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1499558059.0000000003823000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498956493.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1497138389.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498985660.000000000381E000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmpfalse
                                                                                                            http://down.360safe.com/setup.exer0raHcCIH1k2YsFlLn2OIQyk.exefalse
                                                                                                              https://www.360totalsecurity.com/ar/license/360-total-security/360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                http://www.360totalsecurity.com/zh-cn/privacy.htmla=787AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633827080.00000000022A1000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  http://www.360totalsecurity.com/zh-tw/license.htmlera5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    http://www.360totalsecurity.com/zh-cn/license.htmlimeYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      https://www.360totalsecurity.com/ar/privacy/360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 00000003.00000003.1365055968.000002C2D3857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366611630.000002C2D3858000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfsvchost.exe, 00000010.00000003.1360803971.0000015C50710000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabw5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              https://www.360totalsecurity.com/tr/license/360-total-security/360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsvchost.exe, 00000010.00000003.1361104580.0000015C5073B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361168117.0000015C50763000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabu5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830717930.00000000022A4000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    http://www.360totalsecurity.com/en/license.htmlupYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445267785.0000000002365000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446798919.0000000002364000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444895850.0000000002362000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740492838.0000000002288000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabk5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1826765473.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        https://www.360totalsecurity.com/it/license/360-total-security-essential/360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabeYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            https://www.360totalsecurity.com/en/license/360-total-security/360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              http://www.360totalsecurity.com/en/privacy.html=7b(8987AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627249205.00000000022A8000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1627074041.00000000022A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                https://t0.ssl.ak.dynamic.tiles.virtuHVsvchost.exe, 00000003.00000003.1365072003.000002C2D3832000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  https://www.360totalsecurity.com/hi/license/360-total-security/360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    http://www.360totalsecurity.com/en/license.htmluPYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      https://www.360totalsecurity.com/pl/privacy/360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsvchost.exe, 00000010.00000003.1448409308.0000015C50776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1547788294.0000015C50786000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1547578522.0000015C50774000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1516297808.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1532385635.0000015C5070F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1427532948.0000015C5070E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1427511081.0000015C50707000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabhr0raHcCIH1k2YsFlLn2OIQyk.exe, 00000015.00000002.1508591553.00000000006C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cab..)5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829485288.00000000022A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabupdateYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1830855153.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829612545.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                http://www.360totalsecurity.com/en/license.htmltd5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1834112875.0000000002291000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  https://signup.live.com/signup.aspxsvchost.exe, 00000010.00000003.1361147575.0000015C50740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50755000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360710020.0000015C5072C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    http://www.360totalsecurity.com/en/privacy.htmlupqYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80601svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1361447426.0000015C50756000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80600svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          https://www.360totalsecurity.com/ja/license/360-total-security/360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            http://channel.360totalsecurity.com/ins?m2=%s&v611=%s&ch=%s&sch=%s%s?%skeyref_linkPhttps://orion.ts.YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498433469.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1498956493.0000000004D42000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1497138389.0000000004D41000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 00000024.00000000.1739500796.0000000000410000.00000002.00000001.01000000.00000018.sdmp, 360TS_Setup.exe, 0000002A.00000000.1816279110.00000000004D0000.00000002.00000001.01000000.0000001A.sdmpfalse
                                                                                                                                                                              https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80603svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                https://www.360totalsecurity.com/de/privacy/360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAAsvchost.exe, 00000010.00000003.1446325265.0000015C50729000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    https://www.360totalsecurity.com/pt/license/360-total-security-essential/360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      https://dev.ditu.live.com/REST/v1/Transit/Stops/svchost.exe, 00000003.00000002.1366782010.000002C2D3881000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80605svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab?5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1828743881.0000000002291000.00000004.00000020.00020000.00000000.sdmp, 5HEEZMiEnWqR242MeEoxlGRh.exe, 00000027.00000003.1829021477.00000000022A2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80604svchost.exe, 00000010.00000003.1360710020.0000015C50729000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1360849068.0000015C50752000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              http://www.360totalsecurity.com/en/privacy.htmle.7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740352413.0000000002281000.00000004.00000020.00020000.00000000.sdmp, 7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000003.1740492838.0000000002288000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                https://www.360totalsecurity.com/fr/license/360-total-security/360TS_Setup.exe, 360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 00000003.00000002.1366434447.000002C2D3844000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1365040245.000002C2D3843000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1366735784.000002C2D3863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1364619028.000002C2D3862000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    https://www.360totalsecurity.com/en/privacy/60-tot360TS_Setup.exe, 0000002A.00000003.1854970267.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1854173006.0000000008842000.00000004.00000020.00020000.00000000.sdmp, 360TS_Setup.exe, 0000002A.00000003.1855752775.0000000008842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      http://www.360totalsecurity.com/zh-cn/privacy.htmlderYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1443891804.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1444824065.0000000002351000.00000004.00000020.00020000.00000000.sdmp, YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1449273524.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        http://www.360totalsecurity.com/en/license.htmloWEn7FamwTPi2SttiX4DgdTFvBP1.exe, 00000023.00000002.1742508256.00000000008A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          http://www.360totalsecurity.com/en/privacy.htmldeYBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1445327048.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            https://www.360totalsecurity.com/zh-cn/license/360-total-security/360TS_Setup.exe, 0000002A.00000003.1854970267.00000000087C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabp=YBwX8KjTjRCKU7PVUt7ohrmo.exe, 00000012.00000003.1446942011.0000000002351000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                http://www.360totalsecurity.com/en/privacy.htmldYvG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688655164.00000000023CD000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688857753.00000000023CE000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000003.1688525214.00000000023C1000.00000004.00000020.00020000.00000000.sdmp, vG59IrPYDLqWmCOO9Pfbpgeu.exe, 0000001E.00000002.1697875146.00000000023CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  http://schemas.xmlsoap.org/ws/2005/02/trust/Issuesvchost.exe, 00000010.00000003.1427569515.0000015C5076E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1399313091.0000015C50755000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1448354248.0000015C50766000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446796598.0000015C5076D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.1446963144.0000015C5076E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    http://www.360totalsecurity.com/en/privacyDD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000002.1577827505.0000000002245000.00000004.00000020.00020000.00000000.sdmp, DD12FHVAYroWK47l2n2nUb6f.exe, 00000018.00000003.1572060624.0000000002243000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000002.1633863682.00000000022A5000.00000004.00000020.00020000.00000000.sdmp, 87AZujGvMD0DS3bxBzittT7r.exe, 0000001B.00000003.1629073241.00000000022A3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                      https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 00000003.00000002.1366216352.000002C2D383F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                        http://schemas.xmlsoap.org/ws/2005/02/scsvchost.exe, 00000010.00000003.1552419745.0000015C50766000.00000004.00000020.00020000.00000000.sdmpfalse

                                                                                                                                                                                                                          World Map of Contacted IPs

                                                                                                                                                                                                                          • No. of IPs < 25%
                                                                                                                                                                                                                          • 25% < No. of IPs < 50%
                                                                                                                                                                                                                          • 50% < No. of IPs < 75%
                                                                                                                                                                                                                          • 75% < No. of IPs

                                                                                                                                                                                                                          Public IPs

                                                                                                                                                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                          54.76.174.118
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                                          54.77.42.29
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                                          18.245.60.119
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                                          18.66.102.36
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		3MIT-GATEWAYSUSfalse
                                                                                                                                                                                                                          82.145.213.41
                                                                                                                                                                                                                          		unknownUnited Kingdom
                                                                                                                                                                                                                          		39832NO-OPERANOfalse
                                                                                                                                                                                                                          18.245.60.116
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                                          151.236.118.173
                                                                                                                                                                                                                          		unknownRussian Federation
                                                                                                                                                                                                                          		204720CDNETWORKSRUfalse
                                                                                                                                                                                                                          5.42.96.78
                                                                                                                                                                                                                          		unknownRussian Federation
                                                                                                                                                                                                                          		39493RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRUfalse
                                                                                                                                                                                                                          18.66.102.108
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		3MIT-GATEWAYSUSfalse
                                                                                                                                                                                                                          104.192.108.17
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		55992QIHOOBeijingQihuTechnologyCompanyLimitedCNfalse
                                                                                                                                                                                                                          40.126.31.67
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                          20.42.73.29
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                          199.232.214.172
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		54113FASTLYUSfalse
                                                                                                                                                                                                                          18.245.60.13
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                                          18.66.102.80
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		3MIT-GATEWAYSUSfalse
                                                                                                                                                                                                                          104.20.3.235
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                          18.245.60.102
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                                          104.192.108.20
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		55992QIHOOBeijingQihuTechnologyCompanyLimitedCNfalse
                                                                                                                                                                                                                          82.145.215.156
                                                                                                                                                                                                                          		unknownUnited Kingdom
                                                                                                                                                                                                                          		39832NO-OPERANOfalse
                                                                                                                                                                                                                          20.101.57.9
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                          13.89.179.12
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                                          18.66.102.115
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		3MIT-GATEWAYSUSfalse
                                                                                                                                                                                                                          104.20.4.235
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                          188.114.97.3
                                                                                                                                                                                                                          		unknownEuropean Union
                                                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                          186.145.236.93
                                                                                                                                                                                                                          		unknownColombia
                                                                                                                                                                                                                          		14080TelmexColombiaSACOfalse
                                                                                                                                                                                                                          184.28.90.27
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		16625AKAMAI-ASUSfalse
                                                                                                                                                                                                                          190.224.203.37
                                                                                                                                                                                                                          		unknownArgentina
                                                                                                                                                                                                                          		7303TelecomArgentinaSAARfalse
                                                                                                                                                                                                                          108.138.24.221
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                                          54.255.136.181
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                                          104.21.76.57
                                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                                          Private

                                                                                                                                                                                                                          IP
                                                                                                                                                                                                                          127.0.0.1

                                                                                                                                                                                                                          General Information

                                                                                                                                                                                                                          Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                                                                                          Analysis ID:1481333
                                                                                                                                                                                                                          Start date and time:2024-07-25 07:59:12 +02:00
                                                                                                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                          Overall analysis duration:0h 16m 13s
                                                                                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                          Report type:full
                                                                                                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                          Number of analysed new started processes analysed:48
                                                                                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                                                                                          Number of injected processes analysed:0
                                                                                                                                                                                                                          Technologies:
                                                                                                                                                                                                                          • HCA enabled
                                                                                                                                                                                                                          • EGA enabled
                                                                                                                                                                                                                          • AMSI enabled
                                                                                                                                                                                                                          Analysis Mode:default
                                                                                                                                                                                                                          Analysis stop reason:Timeout
                                                                                                                                                                                                                          Sample name:LisectAVT_2403002C_44.exe
                                                                                                                                                                                                                          Detection:MAL
                                                                                                                                                                                                                          Classification:mal100.rans.bank.troj.expl.evad.winEXE@134/1278@0/31
                                                                                                                                                                                                                          EGA Information:
                                                                                                                                                                                                                          • Successful, ratio: 25%
                                                                                                                                                                                                                          HCA Information:
                                                                                                                                                                                                                          • Successful, ratio: 64%
                                                                                                                                                                                                                          • Number of executed functions: 91
                                                                                                                                                                                                                          • Number of non-executed functions: 210
                                                                                                                                                                                                                          Cookbook Comments:
                                                                                                                                                                                                                          • Found application associated with file extension: .exe
                                                                                                                                                                                                                          • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                                                                                                                          Warnings

                                                                                                                                                                                                                          • Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe, MoUsoCoreWorker.exe
                                                                                                                                                                                                                          • Execution Graph export aborted for target 360TS_Setup.exe, PID 1548 because there are no executed function
                                                                                                                                                                                                                          • Execution Graph export aborted for target LisectAVT_2403002C_44.exe, PID 2440 because it is empty
                                                                                                                                                                                                                          • Execution Graph export aborted for target YBwX8KjTjRCKU7PVUt7ohrmo.exe, PID 8140 because there are no executed function
                                                                                                                                                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                          • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtDeleteValueKey calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtReadFile calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtSetValueKey calls found.
                                                                                                                                                                                                                          • Report size getting too big, too many NtWriteFile calls found.
                                                                                                                                                                                                                          • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                                                                                          • VT rate limit hit for: LisectAVT_2403002C_44.exe

                                                                                                                                                                                                                          Simulations

                                                                                                                                                                                                                          Behavior and APIs

                                                                                                                                                                                                                          TimeTypeDescription
                                                                                                                                                                                                                          02:00:05API Interceptor4x Sleep call for process: svchost.exe modified
                                                                                                                                                                                                                          02:00:16API Interceptor3700036x Sleep call for process: MSBuild.exe modified
                                                                                                                                                                                                                          03:27:04API Interceptor6x Sleep call for process: WerFault.exe modified
                                                                                                                                                                                                                          03:27:29API Interceptor2x Sleep call for process: YBwX8KjTjRCKU7PVUt7ohrmo.exe modified
                                                                                                                                                                                                                          08:00:20AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dFBhuG7x7cuyTo0UEY1FLx3F.bat
                                                                                                                                                                                                                          09:27:15AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aWJAM7LmGVjrqyGFkBX76m6y.bat
                                                                                                                                                                                                                          09:27:23AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jLw9YTEqZHJtGfgAlmf6QvQQ.bat
                                                                                                                                                                                                                          09:27:32AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jThuXZ4voJcJhbCjFEaBHzHv.bat
                                                                                                                                                                                                                          09:27:51AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kGFe11FaCHj8Cq6LEsxAKO9Q.bat
                                                                                                                                                                                                                          09:28:12AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kV5jXmTcsMiETlF8iRGxyKFt.bat
                                                                                                                                                                                                                          09:28:25AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lKmPsTV4YA7CYpmS0qsQItFO.bat
                                                                                                                                                                                                                          09:28:46AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sksCZf6BD8bmyHJVUY7BoElf.bat
                                                                                                                                                                                                                          09:28:54AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vnAGf0bQ9J14q0sRMygGsW8l.bat
                                                                                                                                                                                                                          09:29:08AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run QHSafeTray "C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe" /start
                                                                                                                                                                                                                          09:29:26AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0hV0gAK22xvEtgvyKQ5yOs5n.bat
                                                                                                                                                                                                                          09:29:40AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0Sw8mVAoATaNcrREXaxGRBLH.bat
                                                                                                                                                                                                                          09:30:00AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\12nUoaii9IJe2xngOop8SVeq.bat
                                                                                                                                                                                                                          09:30:22AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2oUhX6pmbSfP1XUMNBGb5PG7.bat
                                                                                                                                                                                                                          09:30:44AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\35EAKu09UWgttv2GImwXAjnd.bat

                                                                                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                                                                                          IPs

                                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                                          Domains

                                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                                          ASNs

                                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                                          Dropped Files

                                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                                                                          C:\Program Files (x86)\1721892447_0\360TS_Setup.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:modified
                                                                                                                                                                                                                          Size (bytes):104329184
                                                                                                                                                                                                                          Entropy (8bit):7.994786831397016
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1572864:rrhlntXB9C/S9UA7dhZ76B/MCQf7Z48YHkatX1lg8zOYr6BgUD82LEOtYI:HnGWUA7dhwB0F14JHkax128OYr6982N
                                                                                                                                                                                                                          MD5:B56AE4EF6D244BC96CE23A140FF0411E
                                                                                                                                                                                                                          SHA1:8306784137B831B808875A08ECE410116E0154B2
                                                                                                                                                                                                                          SHA-256:F88AE4717D54F92C3E939014C20B3C99FB968BE9E8092D09AF146C53CE884B48
                                                                                                                                                                                                                          SHA-512:A8AB91BE36DDDC3A6AA634F21F94927101CC6C4DEA65B4EFFDEC97598D97F52D60474E451D4B82AFF0249F07F18E330DDE1BF34D4AE269ED9CA20D5134AF8073
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................i.r......q......7.......g......`......7.......7.......n.............`.B....p......u.....Rich....................PE..L...(.Cf......................(.....K.............@..........................`8.....zs8...@..................................4..<....P...'"...........7.H)....6.L.......................................@............... ...\...@....................text...|........................... ..`.rdata...E.......F..................@..@.data........P.......4..............@....tls.........@......................@....rsrc....'"..P...(".................@..@.reloc........6.......5.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Program Files (x86)\360\Total Security\config.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):190
                                                                                                                                                                                                                          Entropy (8bit):3.4635267823466696
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:QoylClLtlEllckpAmWlpD/lJlf2luNh4slMLlLjlfKAlROKg23Vml8l4vlW8MLlg:QoylClxellc4Ahltpf2lun+PlzyKp30p
                                                                                                                                                                                                                          MD5:CED3F3D1B1EE172658D683CCA992EF98
                                                                                                                                                                                                                          SHA1:07FEF9E7CB3FE374408B1BAC16DBBFDE029496E4
                                                                                                                                                                                                                          SHA-256:6C6630FF0BE4775EAC74682D1FD4A0DE91FC3CF6C6FDEAE1C8E9019828C542F8
                                                                                                                                                                                                                          SHA-512:DE2B3EC20AD19676172B7779CD3ED3A7FCAF2A490C01849C47ED5505F7A4B32C429F56C8A8C3009BF5290055BD3D3EEC49762E9B60B728414FB6686A54B1F6CA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:......[.U.I.].....l.a.n.g.u.a.g.e.=.e.n.....t.i.t.l.e.=.3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y.....c.h.a.n.n.e.l.=.W.W...M.a.r.k.e.t.a.t.o.r...C.P.I.2.0.2.3.0.4.0.5.....s.c.h.a.n.n.e.l.=.0.....

                                                                                                                                                                                                                          C:\Program Files (x86)\360\Total Security\i18n\i18n.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):246
                                                                                                                                                                                                                          Entropy (8bit):3.634921227701681
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Qdiey8ellcb/lxellcjDIlIaDlw7ftlIOlivClIa0EUOlivClIasDfblivn:QdiewnG4noDIlIa5whl7iKlIa0nOliKb
                                                                                                                                                                                                                          MD5:DFC82F7A034959DAC18C530C1200B62C
                                                                                                                                                                                                                          SHA1:9DD98389B8FD252124D7EABA9909652A1C164302
                                                                                                                                                                                                                          SHA-256:F421332FD132D8405CAD34871425C9922E4A1B172D74F86B9E4E7EE750205919
                                                                                                                                                                                                                          SHA-512:0ACB2A043303AB1C033313D62B9B4DAD8CA240E345195C87776F99F129A93946036835872B336A8EFD996657C37ACF56DA7C01D68ADD340408E8FCE72FC66FE5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:......[.M.a.i.n.].....L.a.n.g.u.a.g.e.=.e.n.....D.e.f.a.u.l.t.L.a.n.g.u.a.g.e.=.e.n.....[.F.o.n.t.].....N.a.m.e.1.=.._.ck......S.i.z.e.1.=.-.1.2.....N.a.m.e.2.=.T.a.h.o.m.a.....S.i.z.e.2.=.-.1.2.....N.a.m.e.3.=.0}.f.....S.i.z.e.3.=.-.1.2.....

                                                                                                                                                                                                                          C:\Program Files (x86)\360\Total Security\softmgr\AdvUtils.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):74
                                                                                                                                                                                                                          Entropy (8bit):3.052330729733677
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:QV5/YlLllTKNSQRllTn:QVRYl5BDQzBn
                                                                                                                                                                                                                          MD5:B4786A486748B839257F7227ED99F3B2
                                                                                                                                                                                                                          SHA1:1013F7CB305DC887FD331FA40E9982D6CCE1031E
                                                                                                                                                                                                                          SHA-256:8A5896D10FA74CCCCBE8D57BD1EA2FC7B28313FC1BAD80F758DA0E7965EF80BF
                                                                                                                                                                                                                          SHA-512:648B678C2F4780850DEB19484C4A5E55E0A5FCC11C27B037E293897670BE7FDE0BB0632426C8D3E4200FC18CD16C4E32EF2470C33A9A815519E34071C86A093F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:......[.q.u.r.l.].....l.a.n.g.=.e.n.....d.e.f.a.u.l.t._.l.a.n.g.=.e.n.....

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\360DeskAna.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):228920
                                                                                                                                                                                                                          Entropy (8bit):6.588902317739037
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:78oAPH6BdWT0N7JdQ8oH4SefaqNxTQPBFMmNWU4k/uwgUo9Bpqc8rz3nYDddyj9:CvdO1dQ8JxsPBhuwQq7Y09
                                                                                                                                                                                                                          MD5:9C914DA5BA91EC1854EFFA03C4EF6B27
                                                                                                                                                                                                                          SHA1:A2DFC7D70B5FEDC961B0BC6126962139BC848EA3
                                                                                                                                                                                                                          SHA-256:F78EEE64134AA2FCA1D6EECAA8AD2C3BF9E54C232554525AC4783768DAA677E1
                                                                                                                                                                                                                          SHA-512:266EFE7361A4226A5FCF81FD11AE96F7131E8911ADF6955423BF054D825C210B634BD1A2AC2F112C5B85FDA9AA1B9CA07E3646179BF9977724BC5B4E9E7DCA42
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........=O..\!..\!..\!.`. ..\!..4%..\!..4"..\!..:%..\!..:$..\!.Y5 ..\!..1$..\!..$...\!._...\!.V5%..\!.V5$..\!..:'..\!..;$..\!..;%..\!.Y5%..\!.Y5$..\!..4$..\!..: ..\!..\ ..]!._5(..\!._5..\!..\...\!._5#..\!.Rich.\!.........PE..L...:..^.................8..........P<.......P....@..................................`....@.....................................,.......8Q...........B...;...`..........p...........................p...@............P...............................text....6.......8.................. ..`.rdata...w...P...x...<..............@..@.data...`(....... ..................@....rsrc...8Q.......R..................@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\360DeskAna64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):222264
                                                                                                                                                                                                                          Entropy (8bit):6.34289287185661
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:MB1yXwSGX9Iu1NPDnmyIkGX91y1Wh3m7OaZBPvJrz3nYu9I:MB1uW1RDnmQoHyJC2ldYu9
                                                                                                                                                                                                                          MD5:4B26B4B4F38FEE644BACCEFC81716C6C
                                                                                                                                                                                                                          SHA1:6036D5F882E7E189859E58FBBD4421A2B09B58DC
                                                                                                                                                                                                                          SHA-256:48B9596B3C7B1AF2C0C5CD62A815F7E43DEAC03AE3E91DA26E8DEC2891C915BE
                                                                                                                                                                                                                          SHA-512:76D2235E29A906C8973374D2EC3CB549222D431695DAF6CEDA2AAEEE95FD5BB35DD57D53A73D9A7BE04FE38D10F81EEE398BB81BF3C104BD0FC17E871D081A60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........1..._.._.._..K..._.7.^.._..\.._..[.._..Z.._..[.._...^.._..Z.._...[.._...Z.._...[.._..Y.._..Z.._..[.._...Z.._..Z.._..^.._..^..._...V.._......_....._...].._.Rich.._.................PE..d...F..^..........".......... ......0 .........@.............................p............`.............................................................8Q...........(...;...`..H...P]..p....................^..(....]............... ..(............................text...h........................... ..`.rdata....... ......................@..@.data...X+......."..................@....pdata..............................@..@.rsrc...8Q.......R..................@..@.reloc..H....`.......$..............@..B........................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\360Util.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):692192
                                                                                                                                                                                                                          Entropy (8bit):6.565233888192611
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:IpsvoQzr56X7kRUiWs5a1uw1QVyRJB12sq8nqsPgR7A1f0TLgeodDMyL9S:Ipsv/zr56X70dGfnDnqsPOIf0HgZdIME
                                                                                                                                                                                                                          MD5:D9A8493F1CE7B60653F7FB2068514EFF
                                                                                                                                                                                                                          SHA1:C8C0DA14EFEB1A597C77566BEED299146E6C6167
                                                                                                                                                                                                                          SHA-256:77CEE2E41FAD67986C6C6E1426BC6BDAA976B1DCD3B24F381376B201D201581C
                                                                                                                                                                                                                          SHA-512:0B500630E13AEFBA621C0F66AEF5F2528C0FA0C91DEAF19E92999C6377908F53F3A6B23FB90723B890155877AB7B8B40EACD851794B23FF213CC33013734415F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$.......t3..0R..0R..0R.....2R..#..2R..$9..7R..;..2R..#../R..#..4R..9*G.2R..;..1R.....%R..;..:R..q5..3R..q5..:R..;..'R..;..5R..$9..:R..$9..1R..$9../R..0R...S..b:..:R..b:..2R..b:..:R..;..{R..;..1R..;-.1R..0RE.3R..;..1R..Rich0R..........PE..L....5.`...........!.....\...................p.......................................N....@.............................|...,...T.......X............P..H?... .......&..T....................'......8'..@............p...............................text....Z.......\.................. ..`.rdata...0...p...2...`..............@..@.data....W.......,..................@....rsrc...X...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\360Util64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):862688
                                                                                                                                                                                                                          Entropy (8bit):6.14523322128877
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:pPSAAvHV4fZUvfgmaxpu1FCJ6xMYcMk9u:9SAWHV4fZUvfNazu1Hvc8
                                                                                                                                                                                                                          MD5:8B14A80D926FFDAB593B6BC0B002B9C4
                                                                                                                                                                                                                          SHA1:C84C938543EF6D2C42AD0C61F970E3D1CCB3BE44
                                                                                                                                                                                                                          SHA-256:669A13733CE62EDAC298F91F957EBC7C748918D07C7730E94FD930D6141F8078
                                                                                                                                                                                                                          SHA-512:D049F415DB5DC5C38A968251E72930A8A90E126617F514B0566F203435AB8F1E96371C2C8F0F40CC60DBCD48B284BF46369D377EB4FA61E4FEC6DEF054BBB744
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........,>5.MPf.MPf.MPf.<Qg.MPf..Qg.MPf.%Tg.MPf.%Sg.MPf.&Ug.MPf-$Qg.MPf.<Ug.MPf.<Ug.MPf+.f.MPf/$Tg.MPf.*Ug.MPf.*Tg.MPf/$Ug.MPf.$Ug.MPf.%Ug.MPf.&Tg.MPf.&Vg.MPf.&Qg.MPf.MQfoLPf.$Yg.MPf.$Pg.MPf.$.f.MPf.M.f.MPf.$Rg.MPfRich.MPf................PE..d...:5.`.........." .....J..........`........................................P......I.....`..........................................+......`,..,....0...........d......H?...@..........T.......................(....................`...............................text...(I.......J.................. ..`.rdata.......`.......N..............@..@.data....e...P...0...<..............@....pdata...d.......f...l..............@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\360base.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1061608
                                                                                                                                                                                                                          Entropy (8bit):6.710212792740735
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:g2mj42MEVQPGEorkSYPuX/7DkbSrh/qtoT/cgB8SnLF:2jnMEVQuFkS/vkurNqtoTkgCSnJ
                                                                                                                                                                                                                          MD5:B192F34D99421DC3207F2328FFE62BD0
                                                                                                                                                                                                                          SHA1:E4BBBBA20D05515678922371EA787B39F064CD2C
                                                                                                                                                                                                                          SHA-256:58F13D919F44D194827B609B6B267246ABC47134BB202472C0DFE033B9D7ED73
                                                                                                                                                                                                                          SHA-512:00D4C7A0A0097EB4B31A71A0EAF6FF0D44619F77A335C75688565E34E6D7F4FB6C258917457D560C6B0A5077603845CE012E01D9862E87FB5327D7F8DA970F95
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.........s.............Nk.....Nk.\...Nk.....1......._......._.......................dW.................................................................o.......R.......R.......R..............R.......Rich............................PE..L....E.d...........!.........j...............................................`.......3....@..........................7......h8..........................P,..........Pw..T............................w..@...............L............................text............................... ..`.rdata...k.......l..................@..@.data....]...P...(...<..............@....rsrc................d..............@..@.reloc...............j..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\360base64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1301168
                                                                                                                                                                                                                          Entropy (8bit):6.478229662969352
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:kGtlqC59JiWdmE6r7DzyIzcRIfBFEUT62a3muq9Y+Hk3BRyTTAg521LSYyk9z:kGtlqs9JiWdtwBFjT62aSdHk3STTYv
                                                                                                                                                                                                                          MD5:115BA98B5ABE21C4A9124DDA8995D834
                                                                                                                                                                                                                          SHA1:5DD5CAE213A9DBE5EA7729C1D2ACD080F75CFA39
                                                                                                                                                                                                                          SHA-256:80765ADB886050B0F87E30FA62336985DB67C09B25F4D1760194A28FF78899D7
                                                                                                                                                                                                                          SHA-512:1C415C07DD59EF00C7BDCEF35AC8FDEEA88B6F482D266CC12BAB3D4D3005A76EEBBE97D06E5282E1DBE940AB2971FFDCBD0DB2CD1D700C33805CF1831EFE1A3D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.........5.K.[@K.[@K.[@...@F.[@...@.[@...@k.[@.._AA.[@.._AB.[@..XAB.[@K.[@A.[@-._A..[@.._Aj.[@..^Au.[@B..@J.[@B..@I.[@B..@V.[@K.Z@..[@..XAJ.[@..^AJ.[@..^AJ.[@..RA..[@..[AJ.[@..@J.[@K..@J.[@..YAJ.[@RichK.[@........................PE..d...X..`.........." .....*..........(................................................}....`.........................................`...`....................0...........B..........0?..T............................?...............@..@............................text...T).......*.................. ..`.rdata.......@......................@..@.data....K..........................@....pdata.......0......................@..@.rsrc................`..............@..@.reloc...........0...f..............@..B................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\360desktoplite_config.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (378), with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2728
                                                                                                                                                                                                                          Entropy (8bit):3.4501997661232564
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:y84jibnHiMjR6LAX3H69i8TRVzHKTxgHWvW/OMG4V4aQrkHTCO:txHpjR6LOHGTnH2CHWvz6ekHn
                                                                                                                                                                                                                          MD5:317389A32C0D48A482F8453E5BBDE96B
                                                                                                                                                                                                                          SHA1:08C5D3524D5233FF9FCADD92F6277A0318CB1900
                                                                                                                                                                                                                          SHA-256:E4BC20CB89A35695F6A154ADF9F2DA9B9E6E548C49DD08CBC858995235F2503B
                                                                                                                                                                                                                          SHA-512:32A3C2AFC24CDB4DB49A103036A0C86F3DDFEF2731E9E1AF9863DBC70E79BDF0537B7A93523110FF77987BEF09A2245E264F9AF9EEB17BBBD46190F8AD0DDE06
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.8.".?.>.....<.c.o.n.f.i.g.>.......<.a.r.r.a.n.g.e. .c.l.o.s.e._.c.o.u.n.t.=.".3.". .d.a.y._.t.i.m.e._.i.n.t.e.r.v.a.l.=.".7."./.>.......<.w.e.a.t.h.e.r. .d.a.y._.t.i.m.e._.i.n.t.e.r.v.a.l.=.".1.5."./.>.......<.t.h.u.m.b. .c.o.n.t.e.n.t.=."...j.p.g.|...j.p.e.|...j.p.e.g.|...p.n.g.|...b.m.p.|...g.i.f.|...t.i.f.|...t.i.f.f.|...j.f.i.f.|...d.i.b.|...p.p.t.|...p.p.t.x.|...m.p.3.|...a.a.c.|...w.a.v.|...w.m.a.|...m.p.e.g.|...m.p.g.|...d.a.t.|...a.v.i.|...r.a.|...r.m.|...r.a.m.|...m.o.v.|...a.s.f.|...w.m.v.|...r.m.v.b.|...f.l.v.|...m.p.4.|...3.g.p.|...a.m.v.|...p.s.d.|...d.w.g.|...d.o.c.x."./.>.......<.f.i.l.e. .c.o.n.t.e.n.t.=."...d.o.c.|...d.o.c.x.|...d.o.t.|...d.o.t.m.|...p.d.f.|...x.p.s.|...h.t.m.|...h.t.m.l.|...m.h.t.|...m.h.t.m.l.|...x.m.l.|...t.x.t.|...r.t.f.|...w.t.f.|...o.d.t.|...x.l.s.|...x.l.s.x.|...x.l.s.b.|...x.l.t.x.|...x.l.t.m.|...x.l.t.|...c.s.v.|...p.r.n.|...d.i.f.|...s.l.k.|...x.l.a.m.|...x.l.a.|...o.d.s.|.

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\360netbase.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1448448
                                                                                                                                                                                                                          Entropy (8bit):6.806050829993881
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:mAWxXgDTLtuxkPkoAGb+KpPderMvDjQIuL/w1MJD3ndPKrlL6p/nxoMki+22:NWxkTLtyNojf1LvJgVBndM0p/gi+22
                                                                                                                                                                                                                          MD5:14C6B4BBD31F6FD13530BC941CC71D1A
                                                                                                                                                                                                                          SHA1:CE4E38AC82A54F64D318507DDC28F9FFBB378F0F
                                                                                                                                                                                                                          SHA-256:401D8529A84F1D80A439BE8CD4E869202162458E5AFB5E5BAC97C4859BFE8EB5
                                                                                                                                                                                                                          SHA-512:C16D525F1D3FC098B4D6C8B8A872A9013EF2F945F27AF73ED7826F61A2B80D756AE5348105432909ECCC71F03834CD1301F87FA5A0107E0C7137F5C8E3A3CC95
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H.y.....H......H...H...H......H...I...H...3...H....+.H.....H......H......H.......H......H.Rich..H.........................PE..L......\...........!......................... ...............................p............@.........................0\..J....L.......p..................h7......$....#..............................(6..@............ ...............................text...|........................... ..`.rdata..z<... ...>..................@..@.data...d....`.......L..............@....rsrc........p......................@..@.reloc..R...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\360tscommon.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):496096
                                                                                                                                                                                                                          Entropy (8bit):6.489808821775816
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:coK4MftdCfARkv9hqaMk15eeSPYUGEV0rQCaqn6Kd1L0YL+ou:W4Mi/MkClz0rQCa+6KHL+N
                                                                                                                                                                                                                          MD5:E5EA576B85D53437A415BA6F583640B5
                                                                                                                                                                                                                          SHA1:7AF8662445F37459835177248D74F43C944AC4CB
                                                                                                                                                                                                                          SHA-256:90963029EED69B4C47A39973FF1D67DCBC7EA07BA7F3DDDE71A7D83F337EDD77
                                                                                                                                                                                                                          SHA-512:AA976ACE6BE31B6C86FD5479F8269E95CBC0BC27A9374EC9CC70E4A71AFF9737E0B1A38B5269B69459027FFD66FE216B1FD422772B91A189F17144279602DCFF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.W1#.9b#.9b#.9b..b".9b*.b=.9b*.b.9b*.bt.9b=.b$.9b.eTb&.9b.eBb8.9b#.8bu.9b*.b..9b*.b".9b=.b".9b*.b".9bRich#.9b................PE..L.....Yf...........!.....&...<.......`.......@............................................@................................p...x....0...0...........h..H)...p...>..`C...............................4..@............@..d...h...`....................text....$.......&.................. ..`.rdata...f...@...h...*..............@..@.data...dw.......<..................@....rsrc....0...0...2..................@..@.reloc...e...p...f..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\360tscommon64.dll (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1061608
                                                                                                                                                                                                                          Entropy (8bit):6.710212792740735
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:g2mj42MEVQPGEorkSYPuX/7DkbSrh/qtoT/cgB8SnLF:2jnMEVQuFkS/vkurNqtoTkgCSnJ
                                                                                                                                                                                                                          MD5:B192F34D99421DC3207F2328FFE62BD0
                                                                                                                                                                                                                          SHA1:E4BBBBA20D05515678922371EA787B39F064CD2C
                                                                                                                                                                                                                          SHA-256:58F13D919F44D194827B609B6B267246ABC47134BB202472C0DFE033B9D7ED73
                                                                                                                                                                                                                          SHA-512:00D4C7A0A0097EB4B31A71A0EAF6FF0D44619F77A335C75688565E34E6D7F4FB6C258917457D560C6B0A5077603845CE012E01D9862E87FB5327D7F8DA970F95
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.........s.............Nk.....Nk.\...Nk.....1......._......._.......................dW.................................................................o.......R.......R.......R..............R.......Rich............................PE..L....E.d...........!.........j...............................................`.......3....@..........................7......h8..........................P,..........Pw..T............................w..@...............L............................text............................... ..`.rdata...k.......l..................@..@.data....]...P...(...<..............@....rsrc................d..............@..@.reloc...............j..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2753768
                                                                                                                                                                                                                          Entropy (8bit):6.387350183525537
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:IFJi+7OytIt34Ehz1/dggLOkJAwYzlbFks7CYVmyoZEhaTnMtSYXkNgj:IFJi+ayqxdggLBAjl97CymyougMdR
                                                                                                                                                                                                                          MD5:7186838BEC4478B234B432D264658F10
                                                                                                                                                                                                                          SHA1:5CE0F57D2D176E89FD345CAA30E1F0DE0F63E24F
                                                                                                                                                                                                                          SHA-256:E2FA4A52FFBEC327E8678FB584CD6573C7966737251E6AA3CAD113D63C3CA0E3
                                                                                                                                                                                                                          SHA-512:6F1BA31675177C0AAE4BC9CC65690B9F52ABE2292173D7A12BF8816ADA6593B9546DCB7E27CCEC4B592ED42CAD785E0572A8B4DBFF2978C1D7D0DC0F5CDD9D3B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........nd.............h@.......w.......]........d.......g.......q..............w.......w..=....w.. ....].......w......Rich............PE..L...x*.f.................`...r.......F.......p....@...........................*.......*...@...................................!.h.....#..g............).P,...@(.pH...|................................ .@............p.. ............................text...._.......`.................. ..`.rdata..l....p.......d..............@..@.data...<....@"......*".............@....rsrc....g....#..h...4#.............@..@.reloc..*8...@(..:....'.............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3783912
                                                                                                                                                                                                                          Entropy (8bit):6.188478443667849
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:yIqnYWKGWPPvjMM3jTcfsCnJqVlwoS4Y6KPJRQFqvpQP3TRTi:n3jYNvdhWG
                                                                                                                                                                                                                          MD5:ADDB69F9A976B47243ED7C621C7E5C10
                                                                                                                                                                                                                          SHA1:6F0D78C32984B7DC764DF183B76802F2C2203A11
                                                                                                                                                                                                                          SHA-256:40920438EB1B105449B565D669CBC7F74A7C8499A1EBDC683BBF62499C222A5F
                                                                                                                                                                                                                          SHA-512:4ABA4C7FF23371D667506DA3A2D0C9BBC165070F7E2A66341B27EECE3301C3C1723F96850D8266859C144932232CA1B4DE1057883CA0CFD9DE026A492344C953
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._cqD.............M......<.......P.......z......<.q.....<.r.....<......<.d.(.......N....z.......z.......z.......P.......z......Rich....................PE..d....+.f..........".......'.........."#........@.............................p:.......:...@...................................................0.h.....5..g....3.4f....9.P,... :..$...((...............................................(..............................text...^.'.......'................. ..`.rdata..0.....(.......(.............@..@.data.........1..\....0.............@....pdata..4f....3..h...@2.............@..@text....^....p5.......4.............@.. data..........5.......4.............@..@.rsrc....g....5..h....4.............@..@.reloc...M... :..N...@9.............@..B........................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\DumpUper.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1467456
                                                                                                                                                                                                                          Entropy (8bit):6.696483543500351
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:VfaQrkd3qdmrbcO7FGIJoZv3p7lRr8osPESs47X4und5GUEv5+6FxTPWtwFjI3XE:ZaAkd3caFGIJoZx7lRgosPEHcX4und54
                                                                                                                                                                                                                          MD5:BF7D946721599D16E0FA7EF49A4E0EE4
                                                                                                                                                                                                                          SHA1:74C6404D63AB52AAD2E549B8D9061EE2C350AC5A
                                                                                                                                                                                                                          SHA-256:5F21575642ECF7D38BE30AEF50BE623F74DC3644603E0CB48D1B297AE2066614
                                                                                                                                                                                                                          SHA-512:DD8B5E8233033A3DDB30278B2B82C60925BBCA63EDB68AA1E23C0A6A8F0DD8DA21F60846C747FEA83BE7ED1E99ED86379FFFF7B6AEFDE5FFBB85E3F98732725F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$..........`..u3..u3..u3..t2..u3..t2..u3.v2..u3.q2..u3..p2..u3$.t2..u3..p2..u3..p2..u3...3..u3..r2..u3"Z.3..u3..p2..u3..q2..u3...3..u3&.q2..u3..q2..u3&.p2..u3..p2..u3.p2..u3..q2..u3..s2..u3..t2..u3..t3..u3..p2..u3...3..u3..w2..u3Rich..u3................PE..L......_.............................z............@.................................Qu....@..................................P......................,...7..............T...............................@...............l............................text............................... ..`.rdata..............................@..@.data....d.......2..................@....rsrc..............................@..@.reloc...............^..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\DumpUper.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):255
                                                                                                                                                                                                                          Entropy (8bit):4.848437979222634
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:+FIx9o4hXAUqGXiKeln6HJqmjCCLDOCI4UKxLyKxOXKxV:+mBQln6VjnOCIjMeMIMV
                                                                                                                                                                                                                          MD5:2668CE9C7E8941EA875256EDF1A8AB80
                                                                                                                                                                                                                          SHA1:5633587D5840FB2D4CAAA583BBB3068BAFBEB904
                                                                                                                                                                                                                          SHA-256:4E3CF28EF3CE5B806C632F99482560A5246DE9F86AAFB7A47CDC78E5B4B019A5
                                                                                                                                                                                                                          SHA-512:B92440A8B3DFC54C577A45CD132F07C525300DE90297F89ACE88B7395432CCDC08B3CC9CDA4C523CF82B46D371EB4869A8ED8B3D0720977AFD983634037C61B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:[NCS]..id=16..domainName=http://crash.pcsafe.360safe.com..crashInfoSite=interface/crashinfo..homeSite=pcsafe.safe.com..dumpInfoSite=interface/dumpinfo..productName=pcsafe....[PromoUtil.exe]..showdlg=0....[DsMain.exe]..showdlg=0....[cefutil.exe]..showdlg=0

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\Utils\360ScreenCapture.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):684096
                                                                                                                                                                                                                          Entropy (8bit):6.575312225999228
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:8k1udOg+5XvJComqEAUQLk//b43pPonzLCETseJVo:8kkY1BtEAoHApyzL5Tw
                                                                                                                                                                                                                          MD5:050132ACE215B38E8311E8F3FC11A6F2
                                                                                                                                                                                                                          SHA1:CCAECAF99D9B8ACAFD1632E3735B89D567AF5112
                                                                                                                                                                                                                          SHA-256:234184EE1C37F28EF75A950501E91D6B55C829F66B96696A1A8E83A09BDBE883
                                                                                                                                                                                                                          SHA-512:21B4D364A3EA965ADF7A697F70F64AD6CA660BF0BC6A664DEC00918D4529BF647B36E2F3268EC0F59D7B51F3B6C55D573D45EC2026849DC51B376DC59F59E736
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........jBF...F...F...O...j...X...B...O.......O...[...a<i.G...a<..g...F.......O...&...X...G...O...G...RichF...................PE..L...=..[..........................................@.................................|.....@.................................|...T....`...............8...7...@...5.................................. ...@............................................text............................... ..`.rdata..,\.......^..................@..@.data...(V.......*..................@....rsrc........`......................@..@.reloc...F...@...H..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\Utils\360searchlite.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):936960
                                                                                                                                                                                                                          Entropy (8bit):6.5665988215910565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:cRwv6RBAJ5UP0Yyj4kflQaiZD5wlVUU0KKg3:SLGwPD5Gd07g3
                                                                                                                                                                                                                          MD5:85F76A8481C642654AE58CAF6D1B35A0
                                                                                                                                                                                                                          SHA1:5925A1F3A265311E8D818407062DDF5CEFFFAC3F
                                                                                                                                                                                                                          SHA-256:81399A7379AEBBBFBCE8D8CBC2D482CA04C38DDC91919AE5C6EE3A0F8FB3EA9B
                                                                                                                                                                                                                          SHA-512:7DA2F2550B4BCAD5A5DF5033C44635722724ED68FE97FA9E383032432283AC43E3DBEB0F4080368F86D2E2B54B91A166F5E6280C35F0AE7E8AF3E31C478FB48D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t....Y.u...}.Z.W...j.K.q...S(..u...}.L.....S(..s...S(..o...t.......}.E.d...}.K.....j.[.u...}.^.u...Richt...................PE..L......\.....................h....................@..........................p............@..............................................U..............h7......|e..P...............................@...@............................................text............................... ..`.rdata...g.......h..................@..@.data...Pg...0...@..................@....rsrc....U.......V...R..............@..@.reloc...i.......j..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\Utils\search_file_type.json

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1054
                                                                                                                                                                                                                          Entropy (8bit):4.498856395947475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Oq/yo/XbA3PCZneewP+R0C+tDAwizIh1NSJklV:Opo/rgCZfwbftNizgHU6
                                                                                                                                                                                                                          MD5:28B79C423115A9F4C707C22B8FD33119
                                                                                                                                                                                                                          SHA1:61D190717506E84ECE4BB870562E8B8885A2A9C3
                                                                                                                                                                                                                          SHA-256:D1B7BC9A125CF0FFC0996BDEDEC5E1FA724212FAB340103CEB5BC1BE3C25E686
                                                                                                                                                                                                                          SHA-512:4689FA3E9DB913CC2F17488A110D6B56E434F686C830A42CAED51E5A545CA15EED83436C4073E1FDC8CB9E4B88203E0F9278006C5C1376C22A6B2D2608930F41
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:{..."doc": "doc|docx|dot|dotm|pdf|xps|htm|html|mht|mhtml|xml|txt|rtf|wtf|odt|xls|xlsx|xlsb|xltx|xltm|xlt|csv|prn|dif|slk|xlam|xla|ods|ppt|pptx|pptm|pot|potm|potx|ppsx|pps|ppsm|ppam|thmx|ppa|",..."pic": "bmp|jpg|jpeg|png|gif|tif|tiff|dib|psd|eps|raw|pxr|mac|tga|vst|pcd|pct|ai|fpx|cal|img|wi|eps|ico|cr2|crw|cur|ani|",..."zip": "001|7z|a|apm|ar|arj|bz2|bzip2|cab|cpio|cramfs|deb|dmg|epub|esd|ext|ext2|ext3|ext4|gpt|gz|gzip|hfs|hfsx|hxi|hxq|hxr|hxs|hxw|ihex|img|iso|jar|lha|lib|lit|lzh|lzma|lzma86|ova|pkg|pmd|qcow|qcow2|qcow2c|r00|rar|scap|squashfs|swm|tar|taz|tbz|tbz2|txz|uefif|vdi|vmdk|wim|xar|xip|xpi|xz|z|z01|zip|zipx|",..."app": "exe|bat|msi|",..."movie": "asf|avi|wm|wmp|wmv|rm|rmvb|rp|rpm|rt|smi|smil|m1v|m2p|m2t|m2ts|m2v|mp2v|mpe|mpeg|mpg|mpv2|pss|pva|tp|tpr|ts|m4b|m4p|m4v|mp4|mpeg4|3g2|3gp|3gp2|3gpp|mov|qt|f4v|flv|hlv|swf|ifo|vob|amv|bik|csf|divx|evo|ivm|mkv|mod|mts|ogm|pmp|scm|tod|vp6|webm|xlmv|asx|cue|m3u|pls|qpl|",..."music": "aac|ac3|amr|ape|cda|dts|flac|m1a|m2a|m4a|mid|midi|mka|mp2

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\bell.wav

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 11025 Hz
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):160044
                                                                                                                                                                                                                          Entropy (8bit):7.61031306826666
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:ZfhJ15D35SypCy40SpVkUWtaZm2vrNIXl6aXGlLByAfRrATBc/fA59:ZZ/5ADyKgyeQkGJdfRrAO/I7
                                                                                                                                                                                                                          MD5:BCCA16EDDDD1AC7C3BB3A5F5A0D35AF7
                                                                                                                                                                                                                          SHA1:82ED94F58C6F894D517357F2361B78BEAB7A419D
                                                                                                                                                                                                                          SHA-256:EFFC1CA8846A39001E410B2D8351B76BE093342D139B332AA6260DB01AC820D3
                                                                                                                                                                                                                          SHA-512:E419B6BE471F0C043AEB57074EBDDB02392FDFD6D0BDBC65881E2711885ED15549F394ECA571583090747A0FF0EB1F70C9D2539BC1CA8C20C1B0129D9D24ECF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:RIFF$q..WAVEfmt .........+..D.......data.q..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\config\newui\themes\default\360searchlite\360searchlite_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):149703
                                                                                                                                                                                                                          Entropy (8bit):4.549863563857598
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:Bq5EZuF+YiS8/qy4ppszVNbpwaLLU/gDzEJhj8HKwtI8yriY:xZuwYz8//RLLegs8HKw+
                                                                                                                                                                                                                          MD5:63C5291258FF6E9EBAB439096BD20936
                                                                                                                                                                                                                          SHA1:2DBAC59459BEEED1F8E409A628F04B92ADF57124
                                                                                                                                                                                                                          SHA-256:D83D1BF6AA9A21B4C57973548450B3B2DA43BDBCB2E1AF04E3AEABDF9D3F5F92
                                                                                                                                                                                                                          SHA-512:A1823ADD3DA1A516C56B5A4AF54193E46D18DEA47201CD3ED0DB7AAB91C03EB872074DFEB90F65CBCE58BFD63EC94BF10F7504C3CD3EBA9021D0FA69FCCA4542
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........E.1Mc]...2...2......DesktopSearch.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>.......<.r.e.s.o.u.r.c.e.s.>.........<.i.m.a.g.e.s.>...........<.I.D.I._.S.E.A.R.C.H._.B.U.T.T.O.N. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.s.e.a.r.c.h._.b.u.t.t.o.n...p.n.g."./.>...........<.I.D.I._.W.N.D._.C.L.O.S.E. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.c.l.o.s.e...p.n.g."./.>...........<.I.D.I._.S.O.R.T._.U.P. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.u.p...p.n.g."./.>...........<.I.D.I._.S.O.R.T._.D.O.W.N. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.d.o.w.n...p.n.g."./.>...........<.I.D.I._.W.A.I.T. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.w.a.i.t...p.n.g."./.>...........<.I.D.I._.S.C.R.O.L.L.B.A.R._.H.O.R._.T.H.U.M.B. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.t.h.u.m.b.1...p.n.g.".>.............<.i.m.a.g.e._.p.a.r.t.s.>............

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\config\newui\themes\default\360searchlite_theme.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25312
                                                                                                                                                                                                                          Entropy (8bit):3.576972380209319
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:hznTDu13e42XauZBGfXu+QGWuRQGWuI7RrmurOjXvXH5CeGTNUedDON7uqS6Iluh:m3+j7yxlqpV9V1OtN
                                                                                                                                                                                                                          MD5:BDC55A163963A6D2C5C1D1E7A450A3BC
                                                                                                                                                                                                                          SHA1:1F3B287D55D205648201FD61E950DBB9CE9C256C
                                                                                                                                                                                                                          SHA-256:8E5583274CBACA5D557BD095CF739A5B5F8786337A575D5C1D5DF67545BEFACC
                                                                                                                                                                                                                          SHA-512:411A33DE90A66F0ACA35AB7D03B65D4A8A92612C96DDBD628886E4AF5C1076BFE9258708C04CD85222326244399920866FA827DDC545034C5241513688F09E95
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.t.h.e.m.e.s.>.......<.w.i.n.d.o.w.>.........<.s.e.t.t.i.n.g. .i.c.o.n._.p.o.i.n.t.=.".4.,.4.". .s.h.o.w._.i.c.o.n.=.".1.".>...........<.c.a.n.v.a.s. .n.o.r.m.a.l.=.".0.x.f.f.f.f.f.f.f.f.". .i.m.a.g.e.=.".". .f.i.l.l.=.".1."./.>...........<.b.o.r.d.e.r. .n.o.r.m.a.l.=.".0.x.f.f.0.0.0.0.0.0.". .w.i.d.t.h.=.".1.". .i.n.n.e.r.=.".0.x.0.0.0.0.0.0.0.0."./.>...........<.f.o.n.t. .f.a.c.e.=.".". .c.o.l.o.r.=.".0.x.0.0.0.0.0.0.0.0.". .s.i.z.e.=.".9.". .b.o.l.d.=.".0.". .i.t.a.l.i.c.=.".0.". .u.n.d.e.r.l.i.n.e.=.".0.". .b.i.n.d._.f.o.n.t._.b.y._.l.a.n.g.u.a.g.e.=.".0.". .r.e.f.=."."./.>...........<.s.h.a.d.o.w. .b.o.r.d.e.r.=.".5.,.3.,.5.,.7.". .i.m.a.g.e.=.".../.w.i.n.d.o.w._.s.h.a.d.o.w...p.n.g."./.>...........<.c.a.p.t.i.o.n. .s.h.o.w.=.".1.". .h.e.i.g.h.t.=.".2.0.". .c.o.l.o.r.=.".0.x.f.f.0.0.0.0.0.0."./.>...........<.s.y.s.t.e.m._.b.u.t.t.o.n. .o.f.f.s.e.t._.p.o.s.=.".0.". .c.a.p.=.".0.". .t.o.p.=.".0.".>.

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\config\newui\themes\default\DesktopPlus\DesktopPlus_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2752284
                                                                                                                                                                                                                          Entropy (8bit):7.507895297757676
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:wb/ocvV89OxsR3Xb3HUnC/ocvV89OxsR3Xb3HUnIl3:wbQc9nxM3r30CQc9nxM3r30Ip
                                                                                                                                                                                                                          MD5:E20B0D486CAA3911CE0C425B5C8746F5
                                                                                                                                                                                                                          SHA1:59C181D2DFACC07FEE7001ADBE0F6301DB18F553
                                                                                                                                                                                                                          SHA-256:DDCAD9AE427569F62DA3215069239578F34EFDA606C0A175A1801A91D92B987A
                                                                                                                                                                                                                          SHA-512:D992B1D908A8EC4140C7430E1F0D82DDCB53AE21113DF797E19AFA7F515C9C074385997471A6D0A0293DB916592E705BC7C56A89E557F3D87A5B4425F5588941
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........]/X................DPI_240_image/PK..........aTi...m...m.......DPI_240_image/Blue.png.PNG........IHDR...(...(...... H_...EPLTE..."..".."..".."..".."..".."..".."..".."..".."..K.."..)..8..B..@..4.........tRNS...L..X...W..f.......IDAT8..... .E.P.["...j..z.e..g.9.s....*3..4.........{....{..K.^.aa..y.%..6..zF..V).go.b.'...S^.......3..Di.rb..p...[V...`.s....#s.#..pH.$Z.X..6L....x.....|.....`}a...UXW....g:hs..H.d-..H.Q...Q+.u.?.....IEND.B`.PK..........aTg...............DPI_240_image/check_clr.png.PNG........IHDR...(...(........m....sRGB.........IDATX..?k.A.......Nr. V.E>A4`ea...|...]l......J.."..T......! ..{nw.u...........}.}.3.3s..ZQ.k....W......Z..Y.}.DR..|W~ .k.....R...s..|^..\...T.m..c.un.C*8...?.TF.<....%.S.Y.... u!.%.......E..X.1.TQ@...}nV......%....{...V.?.U)Fz..$.F.........Ll......(...{.O.[.......G...&..x./.m|d..w..\.3.Y..#..w.....{...^.J7BA.LI..}?6.....w.M...%.&.In\6.~.;.:.L6..48.{.j/.g..*./.X.8...>~e..E..gAF.....E.5ttF.i...HYp....}.... #..x. +

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\config\newui\themes\default\default_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1266766
                                                                                                                                                                                                                          Entropy (8bit):7.717853523116026
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:8tTbnF58Bz08JzntxZCBvlh1Ibre6cSJDvpwUBPFc9:8zkJzHZmIbr97NveUtFs
                                                                                                                                                                                                                          MD5:DBA070908030DEBE69FAE6E3C3EEC036
                                                                                                                                                                                                                          SHA1:BAE96347299D945BC691F1A4DA26961971EFF1FB
                                                                                                                                                                                                                          SHA-256:E12832C7A39F43D2F64C75DFF5FFF092E3511671361A5EFEB037AA3B101820C3
                                                                                                                                                                                                                          SHA-512:0349E93CD3E1F1D42E92B72578F13311A5ADE87EB3628A57670002DBE0D48BA30B617C7BB093306977D7B3D49CC8275F9FC0A89CF29890583440E9D2136A8961
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........[.X................Common/PK.........[.X................Common/Image/PK........W.HT........... ...Common/Image/bk_caption_logo.png.PNG........IHDR.............(-.S....PLTE.....F..F..@..F..F...U.&.....?...........F.....F...:..3.6.....F...".3z..x.!..;.....F..E..E........F..F..H.....F..............E........E........E(.5'.4..........................<..:d.&f.#.....................^..."tRNS....../......../..............F11.......IDAT..=.G..0.DE....`C0...r.;...W.#-4...z.VW.PRY...3.T...,.(....d)U.,.....P...."t.....3B....n..p.8t...b.)..J...?..hC7`q,8!.#.A.......a.{P[......*.N.so..t.Uz...'5..;j.&.........O...?....$.Y.....IEND.B`.PK........W.HT...0T...T..."...Common/Image/bk_caption_logo_2.png.PNG........IHDR.............(-.S...]PLTE.............................................................................................Q*......tRNS...'.....i........R.wk^FC+.........IDAT..e.Y..1.Di.gbfw..........]..$\3.i...4cu1..^.w."...gs=.3r!...1D.iaKnP.P....k.@.[.J...g...r.

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\config\newui\themes\default\desktopplus_theme.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75056
                                                                                                                                                                                                                          Entropy (8bit):3.585860792372338
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:ybK2RB35VpTyslblxlIlgl2l2lYlfw0/LeUB2+aWtpDNbWh3Z:ybK2RBpPPxLC68cS1w0/LeUB2+aP
                                                                                                                                                                                                                          MD5:02477FE3F7F3CB351C045672A105BF13
                                                                                                                                                                                                                          SHA1:7AF1F4B90CC20297A07B767C5F1CDBE5BB2661E7
                                                                                                                                                                                                                          SHA-256:0940F591CB25B4D8DA7BB0651E66EA8DDC52810041BC91DD2DA5723FC4367F38
                                                                                                                                                                                                                          SHA-512:F3E9B5F75ACAC05F272CE8E09E5FECF950CFCACF5305A57206920171309AE260F51DC8DDE986CA1272F1858D7C17930D7897258E10591E0AF04A78A41C34119F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.t.h.e.m.e.s.>.......<.w.i.n.d.o.w.>.........<.s.e.t.t.i.n.g._.d.l.g. .i.c.o.n._.p.o.i.n.t.=.".4.,.4.". .s.h.o.w._.i.c.o.n.=.".1.".>...........<.c.a.n.v.a.s. .n.o.r.m.a.l.=.".0.x.f.f.f.f.f.f.f.f.". .i.m.a.g.e.=.".". .f.i.l.l.=.".1."./.>...........<.b.o.r.d.e.r. .n.o.r.m.a.l.=.".0.x.f.f.0.0.0.0.0.0.". .w.i.d.t.h.=.".1.". .i.n.n.e.r.=.".0.x.0.0.2.0.0.0.2.2."./.>...........<.f.o.n.t. .f.a.c.e.=.".". .c.o.l.o.r.=.".0.x.0.0.0.0.0.0.0.0.". .s.i.z.e.=.".9.". .b.o.l.d.=.".0.". .i.t.a.l.i.c.=.".0.". .u.n.d.e.r.l.i.n.e.=.".0.". .b.i.n.d._.f.o.n.t._.b.y._.l.a.n.g.u.a.g.e.=.".0.". .r.e.f.=."."./.>...........<.s.h.a.d.o.w. .b.o.r.d.e.r.=.".5.,.3.,.5.,.7.". .i.m.a.g.e.=.".../.D.e.s.k.t.o.p.P.l.u.s./.i.m.a.g.e./.w.i.n.d.o.w._.s.h.a.d.o.w...p.n.g."./.>...........<.c.a.p.t.i.o.n. .s.h.o.w.=.".1.". .h.e.i.g.h.t.=.".3.0.0.". .c.o.l.o.r.=.".0.x.f.f.2.e.0.0.7.0."./.>...........<.s.y.s.t.e.m._.b.u.t.t.o.n. .o.f.f.s.e.t._.p.

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\config\newui\themes\default\theme.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):280256
                                                                                                                                                                                                                          Entropy (8bit):3.5597264004236266
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:1tZ1cAQcB6C9De7PBE1BIjE5sfkHX8/6KWmNloOrNsq4Kp4txEk88288E+engSLW:1L1ZQgxKBE75sfkooOrkEu+e2Dr3
                                                                                                                                                                                                                          MD5:8EE7254EE8E9F168970CE4C6F6CEFDB8
                                                                                                                                                                                                                          SHA1:CEF726679B56A1F89EBB6FC9B0EBC05CAB196385
                                                                                                                                                                                                                          SHA-256:D7030ACDCB15E89E3E201D379354B48B9637E3F199EC469A5B95C5289FC184F2
                                                                                                                                                                                                                          SHA-512:67FFDC5A2F7BC5CDD7FA9BA099CCC94ACD16BA792BA17A2A63096B3D0A7AE71E9AE54CEFCD5133526FA8D92746BC60ED1883E0987A483909C3961C6AB5041285
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.t.h.e.m.e.s.>.......<.w.i.n.d.o.w.>.........<.w.i.n.d.o.w._.d.e.f.a.u.l.t. .i.c.o.n._.p.o.i.n.t.=.".4.,.4.". .s.h.o.w._.i.c.o.n.=.".0.".>...........<.c.a.n.v.a.s. .n.o.r.m.a.l.=.".0.x.0.0.f.f.f.f.f.f.". .i.m.a.g.e.=.".". .f.i.l.l.=.".1."./.>...........<.b.o.r.d.e.r. .n.o.r.m.a.l.=.".0.x.f.f.6.3.8.c.3.9.". .w.i.d.t.h.=.".0.". .i.n.n.e.r.=.".0.x.f.f.f.f.f.f.f.f."./.>...........<.s.h.a.d.o.w. .b.o.r.d.e.r.=.".1.0.,.1.0.,.1.0.,.1.0.". .i.m.a.g.e.=.".../.c.o.m.m.o.n./.i.m.a.g.e./.W.i.n.d.o.w._.d.e.f.a.u.l.t._.s.h.a.d.o.w...p.n.g."./.>...........<.c.a.p.t.i.o.n. .h.e.i.g.h.t.=.".3.6.". .c.o.l.o.r.=.".0.x.f.f.4.c.b.4.0.7.". .s.h.o.w.=.".0."./.>...........<.s.y.s.t.e.m._.b.u.t.t.o.n. .o.f.f.s.e.t._.p.o.s.=.".5.". .c.a.p.=.".0.". .t.o.p.=.".7.".>.............<.c.l.o.s.e. .w.i.d.t.h.=.".2.2.". .h.e.i.g.h.t.=.".2.2.". .i.m.a.g.e.=.".../.c.o.m.m.o.n./.i.m.a.g.e./.i.c.o.n._.t.o.p.b.a.r._.c.l.o.s.e._.l.i.g.h.t...p.

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\crashreport.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175072
                                                                                                                                                                                                                          Entropy (8bit):6.569280122977913
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:qUWvM9A5UEPeA9ggz/3ezHkta1D+ThXn/n9SGeM7:2Urcz/wEtZlf9b
                                                                                                                                                                                                                          MD5:94A08D898C2029877E752203A477D22F
                                                                                                                                                                                                                          SHA1:D8A4C261B94319B4707EE201878658424E554F36
                                                                                                                                                                                                                          SHA-256:07ED1D3443E7F9B2531AAA0B957A298EA6C5C81BCD321E7FAF25A17A85063169
                                                                                                                                                                                                                          SHA-512:79A2E121665E403767E5278BDBAC6C52F6CE048D0C3968A2FB5053229C5D98E9275ACBC48806C45B8BC2E807F6E52EE4DAD54924B758DB8328FB262C6FD176B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c................................................................>...................................Rich............................PE..L..../.`...........!................................................................?.....@.................................$...x....`.../...........l..H?..........P...............................8...@............................................text...x........................... ..`.rdata..AH.......J..................@..@.data...4G..........................@....rsrc..../...`...0..................@..@.reloc..X ......."...H..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\crashreport64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):204768
                                                                                                                                                                                                                          Entropy (8bit):6.22830582108309
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:vdgwkyK6saI/qiU8zpBoE0wIdFlPwhJHocy0jgD8dXPNwpaojmF55S9heMA:vdgLyK6vilMbdFlPwhJIA8YF1Am09s
                                                                                                                                                                                                                          MD5:F0EC259BC74B69CAC5789922187418B5
                                                                                                                                                                                                                          SHA1:99E738A12DB4A60EE76316AD0A56604A5F426221
                                                                                                                                                                                                                          SHA-256:09EAFEDA04F79FD1FAF273EFE104E877B719FB31689838AA12A3E6D3384A3DA4
                                                                                                                                                                                                                          SHA-512:630CF0A30961AF6D41D24F2D2FC81E0C10C99E19241AFF7E14AA38317EEBBE01E5D85C1CB5848ECFD7B75E2FE762CF4A07FEE781D052B48F0A3C15A37505DAC4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U.u.U.u.U.u....T.u.\... .u.\..._.u.K...Q.u.\...`.u.\...D.u.U.t...u.\...D.u.\...T.u.K...T.u.\...T.u.RichU.u.........PE..d..../.`.........." ......................................................... ......|.....@..........................................[.......O..P......../......h.......H?..........`................................................................................text............................... ..`.rdata...l.......n..................@..@.data....^...`...<...R..............@....pdata..h...........................@..@.rsrc..../.......0..................@..@.reloc..l...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\menuex.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):323136
                                                                                                                                                                                                                          Entropy (8bit):6.803509283610818
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:p9m1jvoDasPczGQtjejVVsW7Apf2YZHB5dtayloL8c/FdgHqW9+c9C:pAFoDasPcFtjnHoF69d9C
                                                                                                                                                                                                                          MD5:273C2D00588D203A9F1486CABACC7C57
                                                                                                                                                                                                                          SHA1:CD7782E5836D645B2244BF30FE91C79FDCFC86D2
                                                                                                                                                                                                                          SHA-256:D14D7DE52C5749549A17E7614BD3DF8278E8595FFCA4110E6289C56A21EEA6DC
                                                                                                                                                                                                                          SHA-512:6CF37C151A21447AC35638AF22F6324ED0C10DF736E5E54BE279B5DB8F68DA86D85EF6FDFA3B4A22B2CCECD98DD37ABDC93B9E8F391A3A90DEB1E4E4990C1779
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.........W=H.9nH.9nH.9n..8oJ.9n...n[.9n..=oJ.9n..:oB.9n.4.nC.9n..8oL.9nI.<oU.9nA.nJ.9n..=oI.9n..=oB.9n..<oJ.9n..<oQ.9n..<oK.9n\.=oL.9n\.?oI.9n\.8o_.9nH.8n..9n..<oL.9n..9oI.9n...nI.9nH..nI.9n..;oI.9nRichH.9n........PE..L......_...........!................P<....... ......................................%.....@.........................@5.......5..,........C...............7.......%......T...............................@............ ..x............................text...X........................... ..`.rdata...1... ...2..................@..@.data...D....`.......:..............@....rsrc....C.......D...J..............@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\menuex64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):397888
                                                                                                                                                                                                                          Entropy (8bit):6.4812987990881
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:W0T3+GaWPxAe7HonHuu0LLt3i7cOTz85gW5+mQMc9fg:W0T3+G7PemHonHELWcYz8jT7c9o
                                                                                                                                                                                                                          MD5:D569954DC1054B6E7D3B495782634034
                                                                                                                                                                                                                          SHA1:DFAF57DA05704261AA54AFAA658D4E61A64FA7F2
                                                                                                                                                                                                                          SHA-256:11294E063FE9A5D5B6019A39B48BEBB75F536E27FF92008C85E9357C95805B80
                                                                                                                                                                                                                          SHA-512:B12E2A6CFE849B5DF21295F4A538DB0381F2FB8C63B8B4DFCA9778AF16C68D23336140874A64DEB324E39DA0AC52B1F2292812FD02967D415319ADE1EE965B6E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........f.....}...}...}...}...}=Y.|...}.o.|...}.o.|...}(.!}...}(."}...}.n.|...}.j.|...}.n.|...}.n.|...}.n.|...}.n.|...}.l.|...}.l.|...}.l.|...}...}...}.o.|...}<n.|...}<n.|...}<n/}...}..G}...}<n.|...}Rich...}........PE..d......_.........." .....|...l............................................... ......mf....`.........................................P,.......,...........C......d8.......7......$......T...................H...(...0........................*..`....................text...l{.......|.................. ..`.rdata..............................@..@.data....&...P.......>..............@....pdata..d8.......:...R..............@..@.rsrc....C.......D..................@..@.reloc..$...........................@..B................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\sites.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1475648
                                                                                                                                                                                                                          Entropy (8bit):6.239535600767825
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:nrpLo6o/c+H8+VR3Nba2nTUQz5Qo4BdfWPW99g:n9Lofc4pn3NNAQz5QBdoWU
                                                                                                                                                                                                                          MD5:D43FA5904A62445893FE1DB320FF2E7B
                                                                                                                                                                                                                          SHA1:2F888949E9C3CE0F647B97EBC8289AE3F2F2EAAE
                                                                                                                                                                                                                          SHA-256:074F19878542B07060BCF7A10238AAC2571EDA75F6596FED6A0A1F7E884F2305
                                                                                                                                                                                                                          SHA-512:1589551E1B5F2C8794F56543EB472C1A801F6DD6B338FFE406BF91BF39061A9022FE13C9A460589A42F243F5329193FF2AE32B1112252FC78D0321C68313B34C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........MM..,#X.,#X.,#XAc.X.,#X.T.X.,#X.T.X.,#X..NX.,#X.~.X.,#X.,"X..#X..XX.,#X..MX.,#X.T.X<,#X.T.XF,#X.T.X.,#X.~.X.,#X.,.X.,#X.T.X.,#XRich.,#X........................PE..L...a.._...........!.....R...*.......T.......p.......................................-....@.................................t...........8-...........L...7...........y..............................x...@............p..L............................text...'P.......R.................. ..`.rdata...B...p...D...V..............@..@.data...8...........................@....rsrc...8-...........(..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\sites64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2162752
                                                                                                                                                                                                                          Entropy (8bit):6.001799015266912
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:wtvksjjbE3br5GT0m+8Au/K7YlWaP+K3uTj+F/Mocutf1I1EOBnW/9H:CMsu5GdvKa8Rw1I1E7
                                                                                                                                                                                                                          MD5:4BD489F48461DE0098F046EEB0FCFB1E
                                                                                                                                                                                                                          SHA1:047C39F1B52602EB19655C4CE42D67E8AAABEB9A
                                                                                                                                                                                                                          SHA-256:E751410539C790554EF7E3F198689B61ED06955A608DC1FCB392BB4B7FE522C6
                                                                                                                                                                                                                          SHA-512:A97929D19B9FBA341BC52BB96EEA0C97A952F3ED2E6CF233CEF9B38B3FD678F0B85C1703FE4C0D6F9C6CA3E6577716E564F92E9B36F7806AE0F5DC3C15F9CAA8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........l..?..?..?r..?..?..?..?..?..?.,.?..?.,.?..?..?..?.,.?..?.,.?..?..?..?..?p.?..?u.?..?..?..?..?...?..?..?..?Rich..?........................PE..d......_.........." .....t...................................................0!.....z.!...@.............................................................8-............ ..7.... .P...0................................................................................text...nr.......t.................. ..`.rdata..............x..............@..@.data....L...0......................@....pdata...............&..............@..@text.................@..............@.. .rsrc...8-...........P..............@..@.reloc.. F.... ..H...~ .............@..B................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\360TotalSecurity\DesktopPlus\sweeper\360FastFind.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):232008
                                                                                                                                                                                                                          Entropy (8bit):6.630006002990767
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:kcUTb3+ZC842kctXc35QMKwnESS7nNKlPQLM/8aLhqI6eNWHMtEQKOKxn5rnONc:Gb3kZk2XI5QMx6MZ/8atq5eAsiPbxD
                                                                                                                                                                                                                          MD5:05A04412B0A86F848EB92A97E81F3821
                                                                                                                                                                                                                          SHA1:A6495836BB9915EEC2C559077A44861D2C5C8182
                                                                                                                                                                                                                          SHA-256:45A9D2180BC3A6C5716A5CCBF74B14D9E91FA706449AAE4046C0835CC672F5E5
                                                                                                                                                                                                                          SHA-512:9074AC8882BCECAFE4726EBE9625B57EC4410CC2F9A8293462287C76F0904B1B9D4AC181EDD99A3E525A36B307497B3242390FE19D41ED2420B3D70682E67244
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.....F...F...F.sDF...F.sRF...F.sUF...F..F...F...FW..F.s[F...F.sCF...F.YEF...F.s@F...FRich...F................PE..L......[...........!................].....................................................@.............................R... ........p..h............R...7......d.......................................@............................................text...W........................... ..`.rdata..Ra.......b..................@..@.data....E... ......................@....rsrc...h....p......................@..@.reloc.../.......0... ..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8192
                                                                                                                                                                                                                          Entropy (8bit):0.35901589905449205
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:6xboaaD0JOCEfMuaaD0JOCEfMKQmDkxboaaD0JOCEfMuaaD0JOCEfMKQmD:ZaaD0JcaaD0JwQQnaaD0JcaaD0JwQQ
                                                                                                                                                                                                                          MD5:7D48941DB05D2D1C9A0C52739933543F
                                                                                                                                                                                                                          SHA1:4FF1446A7D5DA6BBEA145000B00A9F4FFED90930
                                                                                                                                                                                                                          SHA-256:C436AB7F36E238365FDDF5BDFEB9EBFEFACE94AD0FEB79C571182DA968815D87
                                                                                                                                                                                                                          SHA-512:41C7DA95797437840014733F7021883E034503A9D8F07F7C9A0B1131A869A29A6E00D4E9FA99EEDAFBDD2F0DFDAFFB0A7671D8F666DA0E2023CA887E4BA0FB62
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:*.>...........f.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................f.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1310720
                                                                                                                                                                                                                          Entropy (8bit):0.7106824471382038
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqd:2JIB/wUKUKQncEmYRTwh0R
                                                                                                                                                                                                                          MD5:BD93225BD6A8D158AA34376E68992472
                                                                                                                                                                                                                          SHA1:5DCA3BFBAA8E2B6C489C178FF7951D951DB70E4B
                                                                                                                                                                                                                          SHA-256:01A86FF147A06C7B77EFE027A67366686F10DDFEAB1BDF67A890E2FD47A8A8F7
                                                                                                                                                                                                                          SHA-512:9ACE9339D7A07F58D77ECD2036411228E663ABCBF88C973A46801368CABFDC4AB1DF552FDB0B01EBD9DE192DFE66CB6EBCE32C59110E97DE8D82DFBC3C9840C5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:Extensible storage engine DataBase, version 0x620, checksum 0x34a0dc9b, page size 16384, Windows version 10.0
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1310720
                                                                                                                                                                                                                          Entropy (8bit):0.6650833311887698
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:dSB2ESB2SSjlK/2502y0IEWBqbMo5g5+Ykr3g16z2UPkLk+kK+UJ8xUJSSiWjFjF:dazaU+uroc2U5Si6
                                                                                                                                                                                                                          MD5:3E20C0AA4A55DF1237EA5141949AC0F8
                                                                                                                                                                                                                          SHA1:38E5E4F83E7BCEFE81575350B521261A9978003D
                                                                                                                                                                                                                          SHA-256:0E256997A339113A82882D51DFCABEB7D8A6B8BC9EB65EB39B45F61D9751F592
                                                                                                                                                                                                                          SHA-512:4F2805C4540AF365236C1B8E74A492C6B4F55CFF327E92EB0E84803429B0C54AFC3006930226320CE6281A42B392179818F9FD946E7AC96655945A219B52D3B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:4..... .......#.......X\...;...{......................0.e..........|.......|%.h.b..........|..0.e.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{....................................7......|...........................|...........................#......0.e.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16384
                                                                                                                                                                                                                          Entropy (8bit):0.0780753129909801
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:HQUetYeXiUs/XeNzZqYtSq/XQasAio/XollkqqG9lXlZOS:HOzXiUbNzZRSVvNVr
                                                                                                                                                                                                                          MD5:2EB855990697782C0784F62D1EB4262C
                                                                                                                                                                                                                          SHA1:7748A9B67E6EAB7833C20F9525891946BB75B56C
                                                                                                                                                                                                                          SHA-256:8594CF4DBCD7F4B8CBCF51A12836EED7AA2B59D46CD4FD71513DA2351A67E15D
                                                                                                                                                                                                                          SHA-512:6668AB9A0F4A8834797DF0441C99EBF02C73F1CA3A97FB9C3EEA2967AD91FB04B0ABFC1BB53798B3F7E2D841413666D3F1376EB0FA7C1A6E2D8648D7A1F762D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.........................................;...{.......|%......|...............|c......|..........|...........................|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):697182
                                                                                                                                                                                                                          Entropy (8bit):5.235544777058748
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:CBXiKZWAAllNJheaP7Qata8stcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpy10:R+
                                                                                                                                                                                                                          MD5:8376222A9F263D4AB2EBE8BE8C246B4F
                                                                                                                                                                                                                          SHA1:B01E53B5CA41EA0444EB23A7DC6CA77513C197DB
                                                                                                                                                                                                                          SHA-256:670485788FC138F2654A17D95DBA9966ED1D77193F41E95194FA6B7A58FEBB13
                                                                                                                                                                                                                          SHA-512:7987D0855007977ACFBC739A01101FF4B9C7F056C03CC194D37D314A9F0BA2C197881F083E5E995955AF1B83268F99B9AF35439CD6F9004A64145716286A76ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.........Z.W...-.6....@...r...2J.$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\ClipSvc\tokens.dat.bak (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):697182
                                                                                                                                                                                                                          Entropy (8bit):5.235544777058748
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:CBXiKZWAAllNJheaP7Qata8stcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpy10:R+
                                                                                                                                                                                                                          MD5:8376222A9F263D4AB2EBE8BE8C246B4F
                                                                                                                                                                                                                          SHA1:B01E53B5CA41EA0444EB23A7DC6CA77513C197DB
                                                                                                                                                                                                                          SHA-256:670485788FC138F2654A17D95DBA9966ED1D77193F41E95194FA6B7A58FEBB13
                                                                                                                                                                                                                          SHA-512:7987D0855007977ACFBC739A01101FF4B9C7F056C03CC194D37D314A9F0BA2C197881F083E5E995955AF1B83268F99B9AF35439CD6F9004A64145716286A76ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.........Z.W...-.6....@...r...2J.$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7FamwTPi2SttiX4D_f6f0e8ba2f36e7df3f82176663a0488de1695a3e_87611f78_0987f67a-afeb-4a21-8bbf-229ce46b731e\Report.wer

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                                          Entropy (8bit):1.176585345909459
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vGfWB7td0WbkrjeBSgKjzuiFoZ24IO86arW:OfWdteWbkrjUOzuiFoY4IO86p
                                                                                                                                                                                                                          MD5:65608BF1367D1006C9751AB195FD314F
                                                                                                                                                                                                                          SHA1:678996B91E3B029AC14BC9F439FE9B1D9FDBFFD8
                                                                                                                                                                                                                          SHA-256:C65E2C18929025D0DFF926897DAC8526811E37068656F0C87CF828B366649812
                                                                                                                                                                                                                          SHA-512:E20E92B24245EA2C3F38344EC0B3C94E601143AEACA89577DFA89362DFBA95BF195D91364AD7E0CC2B655C5021FFD55829E984F96F60FC78E23F94A479DD2744
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.3.6.6.0.4.6.0.8.3.5.4.1.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.3.6.6.0.4.6.6.1.4.7.8.5.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.9.8.7.f.6.7.a.-.a.f.e.b.-.4.a.2.1.-.8.b.b.f.-.2.2.9.c.e.4.6.b.7.3.1.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.f.f.f.5.9.c.f.-.7.7.7.8.-.4.b.6.3.-.9.5.7.a.-.8.d.7.d.3.4.d.2.a.c.f.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.F.a.m.w.T.P.i.2.S.t.t.i.X.4.D.g.d.T.F.v.B.P.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.3.6.0.I.n.s.t.a.l.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.2.4.-.0.0.0.1.-.0.0.1.4.-.3.5.c.0.-.6.1.1.8.6.4.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.d.7.f.4.c.0.0.f.f.a.3.2.0.f.c.4.6.3.8.6.6.e.d.b.7.0.c.2.5.8.a.0.0.0.0.0.9.0.4.!.0.0.0.0.b.f.f.5.c.e.9.1.0.f.7.5.a.e.a.e.3.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_87AZujGvMD0DS3bx_9093e58a65069a4191ec665c290913eab88a47d_d6d257cf_7b43beae-3f71-4b47-a4cb-f2b3f3bc72be\Report.wer

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                                          Entropy (8bit):0.6173080552905706
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:VHV57HX9Z5tshmh11yDfXQXIDcQ4c6fcE+cw3ykZZAX/d5FMT2SlPkpXmTA6f/Vf:NX9tz0WbkkzuiFYZ24IO8E
                                                                                                                                                                                                                          MD5:6FE7903770ACF701F3B39D5E4E06832F
                                                                                                                                                                                                                          SHA1:CD7A13798A8112A477A253D861637B41324E0991
                                                                                                                                                                                                                          SHA-256:8958ECB3E244F9290FFDE84601873AE96AB3DF4B07602043427722A0A19EF2A6
                                                                                                                                                                                                                          SHA-512:3E065228FFF39FAA7504FE29C54419214FDD498AF05B97BC4E4E191CB37967F1EDA5E5CE926B3528A6ADC79DD9F4AB71D29052441A1B288460FF54C74EE7AFDD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.3.6.6.0.3.5.1.8.4.8.6.3.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.3.6.6.0.3.5.7.3.1.7.3.1.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.4.3.b.e.a.e.-.3.f.7.1.-.4.b.4.7.-.a.4.c.b.-.f.2.b.3.f.3.b.c.7.2.b.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.a.a.c.0.a.d.b.-.2.c.d.b.-.4.d.0.2.-.b.7.4.c.-.5.d.a.0.1.9.5.f.8.2.6.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.8.7.A.Z.u.j.G.v.M.D.0.D.S.3.b.x.B.z.i.t.t.T.7.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.3.6.0.I.n.s.t.a.l.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.5.4.-.0.0.0.1.-.0.0.1.4.-.4.5.7.8.-.9.8.1.1.6.4.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.d.7.f.4.c.0.0.f.f.a.3.2.0.f.c.4.6.3.8.6.6.e.d.b.7.0.c.2.5.8.a.0.0.0.0.0.9.0.4.!.0.0.0.0.b.f.f.5.c.e.9.1.0.f.7.5.a.e.a.e.3.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_DD12FHVAYroWK47l_5fb839bf1de495b32949986374b84d94d4fae6a8_e9c9dc8f_64e322ac-69f5-4953-8600-48c966775eb0\Report.wer

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                                          Entropy (8bit):1.1760273718798984
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:b9n2bQ9rbobcosfbTh11yDfXQXIDcQ4c6fcE+cw3yobPob9+HbHg/EFAe4nyNlXq:5J/os0WbkbjeBlJKjzuiFYZ24IO8r
                                                                                                                                                                                                                          MD5:16B72F00C4710B96F15A27736E8E9999
                                                                                                                                                                                                                          SHA1:097FDF4B4D8B8DBF7406DD0D7D3891ED206793CD
                                                                                                                                                                                                                          SHA-256:409924400851657ADD0C2AFB89F17A59EDA4CA62E794AAF5D42561EF664D7B5F
                                                                                                                                                                                                                          SHA-512:9460048E4C5D115D48933FB844632075A1471FB22B8BDF9C89621CF54FE5940D7BFFFD9C294EF0AFDF01B66AF630F82BD939AB30216E39E0FDDA9CA55A6DDBD1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.3.6.6.0.2.9.2.4.9.3.5.0.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.3.6.6.0.2.9.7.8.0.5.8.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.4.e.3.2.2.a.c.-.6.9.f.5.-.4.9.5.3.-.8.6.0.0.-.4.8.c.9.6.6.7.7.5.e.b.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.f.0.9.a.1.d.0.-.e.6.4.7.-.4.4.6.4.-.9.b.8.1.-.c.f.f.6.9.2.5.9.a.1.f.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.D.D.1.2.F.H.V.A.Y.r.o.W.K.4.7.l.2.n.2.n.U.b.6.f...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.3.6.0.I.n.s.t.a.l.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.8.8.-.0.0.0.1.-.0.0.1.4.-.c.6.a.4.-.e.c.0.d.6.4.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.d.7.f.4.c.0.0.f.f.a.3.2.0.f.c.4.6.3.8.6.6.e.d.b.7.0.c.2.5.8.a.0.0.0.0.0.9.0.4.!.0.0.0.0.b.f.f.5.c.e.9.1.0.f.7.5.a.e.a.e.3.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LisectAVT_240300_30926f56636b977de717efc0a33cc4ae6873153_8dafb6ee_37d64a93-2585-4cac-aad3-8809d659c484\Report.wer

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                                          Entropy (8bit):1.6853795959366797
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:xdW3Hirma4o9NLNzYvEtM0m8iq6rzuiF7Y4lO85Vw7:xkHirmaP5mbrzuiF7Y4lO8r
                                                                                                                                                                                                                          MD5:DBDCDE79F965E0CC68F91BDC8CA5591F
                                                                                                                                                                                                                          SHA1:1349108BAD5113AAC8ED474041AFED10BFDBC18E
                                                                                                                                                                                                                          SHA-256:D9642472E41F0728AB2AA68C72097187BF6DE8DCAF423BC0B609E5F7FA4E8AE8
                                                                                                                                                                                                                          SHA-512:26477B7184FC5CCCA7D33FC459C9883196A3213AD3C07A97F63E3245CF2B2D8439542CE5BABBC503C904F8A942C84BB8C5F177210C457611A32C2F3633E06678
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.3.6.0.8.1.5.9.9.5.7.6.3.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.3.6.0.8.1.8.1.0.5.1.3.4.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.7.d.6.4.a.9.3.-.2.5.8.5.-.4.c.a.c.-.a.a.d.3.-.8.8.0.9.d.6.5.9.c.4.8.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.f.3.2.0.6.2.c.-.a.b.c.1.-.4.b.e.e.-.b.a.0.c.-.4.3.7.5.4.8.b.4.7.4.9.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.L.i.s.e.c.t.A.V.T._.2.4.0.3.0.0.2.C._.4.4...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.a.y.a.r.e.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.8.8.-.0.0.0.1.-.0.0.1.4.-.a.7.3.0.-.3.6.e.5.5.7.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.5.b.1.9.4.8.2.8.6.1.4.0.7.f.4.d.2.1.e.3.d.0.9.d.c.c.7.1.e.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.5.4.0.8.2.f.6.4.c.2.7.b.6.3.a.b.3.5.9.2.7.b.8.b.5.b.6.9.f.1.5.5.1.8.1.4.6.c.!.L.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_r0raHcCIH1k2YsFl_8cc313ba89e65827eb2b854a8ee3edf9cb9d41d6_6c9ad7ec_5564019a-2eb2-4a14-af3e-d6e5dd0bf216\Report.wer

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                                          Entropy (8bit):1.175760289107819
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:foBMABIbz/0WbkaJ+jeBlJKjzuiFYZ24IO8tW:fFpb4WbkLjMOzuiFYY4IO8M
                                                                                                                                                                                                                          MD5:58BC833F77C719E997F18B2B06833FDD
                                                                                                                                                                                                                          SHA1:568596897020BA94E3894E02F76F41895B5BC3ED
                                                                                                                                                                                                                          SHA-256:1E9E1EEDD25E6C855E393999CF39B4E5E7E00D87DF0CDFC553BB714A3ACB3F3B
                                                                                                                                                                                                                          SHA-512:6E419440CB09BEF4917150841C0E1C083FF79A9E58DF8666530F19F9AB8082805BD2D0573B86C4435144FEA6285F4F2AA30236282D2EDE29C813234CAFE5ECF6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.3.6.6.0.2.2.6.2.1.7.9.5.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.3.6.6.0.2.3.5.7.4.9.4.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.5.6.4.0.1.9.a.-.2.e.b.2.-.4.a.1.4.-.a.f.3.e.-.d.6.e.5.d.d.0.b.f.2.1.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.6.a.6.c.d.5.-.0.c.4.0.-.4.1.b.e.-.8.a.9.d.-.4.1.8.9.2.e.9.f.9.d.d.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.0.r.a.H.c.C.I.H.1.k.2.Y.s.F.l.L.n.2.O.I.Q.y.k...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.3.6.0.I.n.s.t.a.l.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.5.0.-.0.0.0.1.-.0.0.1.4.-.3.4.f.3.-.7.3.0.a.6.4.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.d.7.f.4.c.0.0.f.f.a.3.2.0.f.c.4.6.3.8.6.6.e.d.b.7.0.c.2.5.8.a.0.0.0.0.0.9.0.4.!.0.0.0.0.b.f.f.5.c.e.9.1.0.f.7.5.a.e.a.e.3.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vG59IrPYDLqWmCOO_a04882b7384f32f8f072aaa56a898cdc35459a3d_1a10aea1_849ed01e-d30a-4dce-b3b1-9119b18df266\Report.wer

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                                          Entropy (8bit):1.1765691949576629
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:ETAEaoxSc7Zl0WbkmZQjeBSgKjzuiFoZ24IO8H8:iaoxSoZGWbkmZQjUOzuiFoY4IO8H8
                                                                                                                                                                                                                          MD5:7C2CBFA48FAEA2E2EB5935125C025E9A
                                                                                                                                                                                                                          SHA1:14D1199749BC33317E48CC49E8FD4698C09DEA5D
                                                                                                                                                                                                                          SHA-256:EFD89B860E681079DE68ADE65A1BA46BD88C7B77CB222E8157913684B22533EE
                                                                                                                                                                                                                          SHA-512:558F5B31BF9C7E2210B256FEB5D78B9C036E1CE6FDBCC1A4ED8617CB1D8ABAD17DB6121DA8063329EE220863ED1DCBB95C587B4C5C8893406BF4054D22B82E2B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.3.6.6.0.4.0.8.8.3.5.2.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.3.6.6.0.4.1.3.9.9.1.3.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.4.9.e.d.0.1.e.-.d.3.0.a.-.4.d.c.e.-.b.3.b.1.-.9.1.1.9.b.1.8.d.f.2.6.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.6.e.b.d.4.4.1.-.5.4.3.e.-.4.4.3.b.-.b.b.2.1.-.d.f.c.e.8.a.1.9.e.b.f.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.v.G.5.9.I.r.P.Y.D.L.q.W.m.C.O.O.9.P.f.b.p.g.e.u...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.3.6.0.I.n.s.t.a.l.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.b.c.-.0.0.0.1.-.0.0.1.4.-.6.8.6.3.-.c.7.1.4.6.4.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.d.7.f.4.c.0.0.f.f.a.3.2.0.f.c.4.6.3.8.6.6.e.d.b.7.0.c.2.5.8.a.0.0.0.0.0.9.0.4.!.0.0.0.0.b.f.f.5.c.e.9.1.0.f.7.5.a.e.a.e.3.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A20.tmp.dmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                          File Type:Mini DuMP crash report, 16 streams, Thu Jul 25 06:00:17 2024, 0x1205a4 type
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2035639
                                                                                                                                                                                                                          Entropy (8bit):2.5490108678347174
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:2NmkXWUAcNJZL5Voqdc7BiQRVYShYgm4D5f6Zgydlop5o4O:2ck5JZ5VoqoBiQRVjgQ5fK
                                                                                                                                                                                                                          MD5:5A0AA1E0234D786BB7FD8E142F0B40C4
                                                                                                                                                                                                                          SHA1:828B741299E8BDF9F604F5570016C54EC8167CA7
                                                                                                                                                                                                                          SHA-256:C4DDA74011D3F993BD0F8246F8D88F592EA281BB67F9FB23B41089D4A25054C9
                                                                                                                                                                                                                          SHA-512:1DC4C734DA5AC7E5D8128C9E0F0EEA9A6A6C2D232CF481384483BE317C0AAC97E4C4C5E48157481E03667FABEF4596FF212586793C9E98FC9587370ABA20956F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MDMP..a..... .........f............t...........(~..........$............!...........3...1..........l.......8...........T...........0{........................................................................................................eJ......h.......Lw......................T.............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER4155.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9126
                                                                                                                                                                                                                          Entropy (8bit):3.712356935656153
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJyTrZ6YNA6epgmfZPyoprZ89bmhmfEim:R6lXJcZ6YO6epgmfAbmQfA
                                                                                                                                                                                                                          MD5:9D88455A1596D214D3AFCF8A4BE0A95C
                                                                                                                                                                                                                          SHA1:43EEED75693E0E8CC3A8880793B70B489BFACF31
                                                                                                                                                                                                                          SHA-256:9EC3555AF66DE2DFC00CBC2963717A2102CECFF050EEF6C83E43D1416AF16FD0
                                                                                                                                                                                                                          SHA-512:C1EE963E36FD69EB7C6427B3AD2A678BC62BDF82734A6382CC9210B8534C4A9CA8B30394C8812C3DAD67DC644559DFAFAF1CD2B100898E1E0FBF0E85DCD0B44B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.4.4.0.<./.P.i.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER4185.tmp.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4870
                                                                                                                                                                                                                          Entropy (8bit):4.533246209601046
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zsuJg771I9wrWpW8VYHYm8M4JFuFE6Fsyq8vbFEOdmuouVnd:uIjfkI7va7VXJFue7WbeOdmuouVnd
                                                                                                                                                                                                                          MD5:9E318334D1B577B4863BFAC4C2E18DB2
                                                                                                                                                                                                                          SHA1:354E5C4485E2E77E9AA4CFD9EA298478985BF829
                                                                                                                                                                                                                          SHA-256:04CACF3486FC0239E451C5D672215D2AC1038DF9024FDF43C8378E1390D347A7
                                                                                                                                                                                                                          SHA-512:E10797C8A296746195CBCCC697D641E49232EBD4A7AC64C1CF7BE879D1ED1353660D97E411D94860CFF61EF56C66BBBE79258F6740486533B3379841607AE8A2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="426062" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER4193.tmp.csv

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):90236
                                                                                                                                                                                                                          Entropy (8bit):3.1190805773137344
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:bbNnODkrLuLFhxYSBTjQbK0gRwox/iyUfEm:bbNnODkrLuLFhxYSBTjQbK0gRwox/iyG
                                                                                                                                                                                                                          MD5:8D5A0E0297E52E4B60679544341FDB7F
                                                                                                                                                                                                                          SHA1:BE2DE3090F726DB8428DB4FBC3D45A462DDE6556
                                                                                                                                                                                                                          SHA-256:D464E2211CD6999C8426CA1894F41EE811A3BECBFBC87CCD31AB338BBF907985
                                                                                                                                                                                                                          SHA-512:56639472C15F37F75B2B4C3B7157E415B449DA275859703885506DD36CE893590942E6C47AAA17C359887B4724BB093D9C1F1676210910312E85B76A95089826
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER4220.tmp.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13340
                                                                                                                                                                                                                          Entropy (8bit):2.6851126183535796
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:TiZYWxPHflWLhYDWYPWgHqYEZFOtEiXkfKswi742wbKai+WkMvwpIjX3:2ZDBwN3z79wOai+WkMvwWjX3
                                                                                                                                                                                                                          MD5:A6D1CA289C0C5AF4A512E7ED7936A9F5
                                                                                                                                                                                                                          SHA1:8B92EF32E5337248118EF336F70CEE3A4749B672
                                                                                                                                                                                                                          SHA-256:42F77976D99EADCC64ACAD04F5A0601CE45AEC213682660DBB4995E2C7ADC7E9
                                                                                                                                                                                                                          SHA-512:D49B54808F3FD8498818F084FCF2971517420A80A35F50B264F4B2B4AC4F592624A70C5A74DADF9A4AEB1CA473B757119CCE9D6785A42464FBA1A4951605E9B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C69.tmp.dmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, CheckSum 0x00000004, Thu Jul 25 07:27:02 2024, 0x1205a4 type
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24036
                                                                                                                                                                                                                          Entropy (8bit):2.868976071313992
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:RSuMwX1TU2X2AhlOXm6XkPjSOLhoBpebLZUkqj2u:mAhl36XwBLqBmFuj2u
                                                                                                                                                                                                                          MD5:DAF2E68F7D76E9682E2E9106800BBB22
                                                                                                                                                                                                                          SHA1:3B2C5B16B93EA6F4A0B6E39E9161018BD565A366
                                                                                                                                                                                                                          SHA-256:1BADE47E801D887C109F5F19135F877B595E413851654842BC390A5451B17067
                                                                                                                                                                                                                          SHA-512:EABFC6123E1A420FDA273D81576329A7E8ECF71FABC45E109350398D735004D16A9C726D8F028262F4D9A573399B71634984182620D5DC73C5A9C0B6EBE7AB8B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MDMP..a..... .......F..f............4...........0"..<.......$....7..........T.......8...........T................I..........l)..........X+..............................................................................eJ.......+......GenuineIntel............T.......P...E..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DF1.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8364
                                                                                                                                                                                                                          Entropy (8bit):3.6868036908398514
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJwVf6dV6YI06A3gmfNMJsNCpry89beQYmsflYWm:R6lXJ66/6YT6A3gmfKJ68eQYFf2f
                                                                                                                                                                                                                          MD5:E482A81F6A7DFF8FC6C7E7431B4F72BE
                                                                                                                                                                                                                          SHA1:3BB5866A3977EC55A3A911AD1B87DA32F6B1C353
                                                                                                                                                                                                                          SHA-256:A067944B2AE2450F58D0CC0D83FB8093FB132D10F3608BA75630934CC12A5235
                                                                                                                                                                                                                          SHA-512:1A12E0ACF0FB4F8B81FA98F9B9567FBFB87C705EB3FF83168744454137D63501C5934BC0401A655835380E8400F105A857C02B06AFBF2D5803CF138348C16201
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.3.6.<./.P.i.d.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E21.tmp.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4733
                                                                                                                                                                                                                          Entropy (8bit):4.512830325099432
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zsTuJg77aI9wrWpW8VY7PYm8M4JwCBY7fFR+q8HP2GKoJJtrt13d:uIjfTkI76a7VSSJ+b635xd
                                                                                                                                                                                                                          MD5:B9A77D978B123EF5B534BCBFD268BB3D
                                                                                                                                                                                                                          SHA1:03470822EAF258F4B5051766884BBA587D007E33
                                                                                                                                                                                                                          SHA-256:CD9C0BFB809A131A3A2C0D961CADC252032A783032D4AEC151B0BDEC36C6402B
                                                                                                                                                                                                                          SHA-512:9F1512332BBE3BB13240EBE3172218502959F881FB873A58467F06D668EB5C653DE85982E549513FC7696FB7820A77F7044B4DCC430E9FA84B2E3333B91B9422
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="426149" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E5F.tmp.csv

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):92568
                                                                                                                                                                                                                          Entropy (8bit):3.1191012275462837
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:Aa/IdMRP85/p3cFSZSWKEjQSBmPb/F1t+J+b6+fgo+ylxkyPZ0:Aa/IdMRP85/p3cFSZSWKEjQSBmPb/F1W
                                                                                                                                                                                                                          MD5:6CA2F05F173B32CA8D7AB32D00195843
                                                                                                                                                                                                                          SHA1:4B208D8E60CE0409C47DC2EB3D4169AC52A270EF
                                                                                                                                                                                                                          SHA-256:8936E7CBA10783D79D29DF7777D25BEB297A4C0249D73A3A32079321ABCEF82E
                                                                                                                                                                                                                          SHA-512:F5B8660149C2A6C1107F374D53522BD8D0589C11D4D892E0D3B919FF7C3EDF2E61CCB0A9AC5AC93C573D24498084D596A465CCC2ADC5178D21FBAF13CE9F11DF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER7FC8.tmp.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13340
                                                                                                                                                                                                                          Entropy (8bit):2.6855714205522436
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:TiZYWbMYGHNYqYuWAHkYEZ1dtHiiVjsKwcFuaV+KMPMsIhvX3:2ZDONdiNkaV+KMPMrpX3
                                                                                                                                                                                                                          MD5:66AEAF879A035E1E6471456BDEA87ADD
                                                                                                                                                                                                                          SHA1:A06D8E34CAD4B333FB9141C769D3401CA3C74E49
                                                                                                                                                                                                                          SHA-256:A0FE06E5EB3359F86E76FAC7C9CFAAA23AFF92A0F12BB96F6725C505E3119FF7
                                                                                                                                                                                                                          SHA-512:139EBF70D649DF842AB6F5F366921C12D51D239ECE31BE1E20454736E79119CB2EE4A2D0F0E05B377F36C7F102DA7525793432EC0075A311990BD30F6EBF4926
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER965A.tmp.dmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, CheckSum 0x00000004, Thu Jul 25 07:27:09 2024, 0x1205a4 type
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24036
                                                                                                                                                                                                                          Entropy (8bit):2.869578469690062
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:iS1MwX1TU2X2AhlOXm6Xk3OLho3elKKgWFGLqZluiUK:UAhl36XvLqtKHVZluiUK
                                                                                                                                                                                                                          MD5:D7C82F5549FA6F3517717D295EF66072
                                                                                                                                                                                                                          SHA1:E32FB9117285E6E85F5FEEF2443C18DA6B38344C
                                                                                                                                                                                                                          SHA-256:83334B20E39358F5FBDE87CC1AE7D7231367EC28E2C4FB105AD8C46E6AF2371D
                                                                                                                                                                                                                          SHA-512:3E7B657E870A7243B3EB6E6E7951508D7CAC3F11F74EA53493B65CDEC3935A9DDD2F565C776FBE380CF314A3371E017E82F6A1D6C0083411F16439B7C46D9368
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MDMP..a..... .......M..f............4...........0"..<.......$....7..........T.......8...........T................I..........l)..........X+..............................................................................eJ.......+......GenuineIntel............T...........K..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER9707.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8368
                                                                                                                                                                                                                          Entropy (8bit):3.692298266015171
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJ5/6b6YI86RgmfDJsNCprT89be6RsfWYYm:R6lXJR6b6Yr6RgmfDJ6De6Kfd9
                                                                                                                                                                                                                          MD5:880ED19BAA6C60106DC66F96CFC9AF1E
                                                                                                                                                                                                                          SHA1:24618E4851B55F7D4CFB15B5B6343153E082B131
                                                                                                                                                                                                                          SHA-256:54ED1C6B0FC4057E183F5E98F7BD55333C90C225F5CAA747B4EAAE1B12920200
                                                                                                                                                                                                                          SHA-512:83139DC7484867735587F27B63DB4D09849436F67A4247035819FD7BDD99DFD4E47B9BC0D5CE807E7E5A8EF2F84759870DB29EDBD3CE790890C7868D5044F133
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.9.2.8.<./.P.i.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER9765.tmp.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4733
                                                                                                                                                                                                                          Entropy (8bit):4.51421139527754
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zsTuJg77aI9wrWpW8VYzcYm8M4JoB9iY7fFD+n+q8jc2GkoJ/BSnS53d:uIjfTkI76a7Vw5JNm6USNd
                                                                                                                                                                                                                          MD5:2B03E59D109886144B2CD4013FC91EE1
                                                                                                                                                                                                                          SHA1:BAD93F1F31C0FB447741CE2F3E6FBDDF531FB034
                                                                                                                                                                                                                          SHA-256:E4B663C2A0F4F29B2FF9D38D1E58539FC65640DDE3265493E030E6114D61231B
                                                                                                                                                                                                                          SHA-512:9BFB2589C8CE122E6B0CFCDE699697062CB46CCE83BE69CC15C321AC7977A9D81EA98D37B68ABAE9A2532964A76745E81CA4E3225F02384F9AACE13BC1DC9590
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="426149" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER9787.tmp.csv

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):91266
                                                                                                                                                                                                                          Entropy (8bit):3.120266471761432
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:c6Ba2XgOU3h2vLdhduKEoEhSBOPb/F1t+J+b6+fgottb+SD04P:c6Ba2XgOU3h2vLdhduKEoEhSBOPb/F1j
                                                                                                                                                                                                                          MD5:0B53C8613E78E1FE2C5AFA8AA8CA997E
                                                                                                                                                                                                                          SHA1:714FA55702C4A5DB4C23F3ABBFDF33A73F80A005
                                                                                                                                                                                                                          SHA-256:87FC9165F5EE4B20A797226004A7AB9FEEF307405B9691AD491E16AC24F52BDE
                                                                                                                                                                                                                          SHA-512:F1A44BF1E042115CFE168BA9AE72491A9A7ADB0504BF264C140D080258EEDAFA42B65F8EAD14839CE4C04BA23287081B502DC46F9C032CC0B868F01B71731906
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WER9814.tmp.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13340
                                                                                                                                                                                                                          Entropy (8bit):2.6851802522606945
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:TiZYWm4A9eHCYrYvAWRHqYEZwiXtHixVns2wr4mag+lCmMN+OISX3:2ZDmAC8Ig9rag+hMN+ZSX3
                                                                                                                                                                                                                          MD5:464C7239EA8F6CC8248C6D3C12EE86BC
                                                                                                                                                                                                                          SHA1:0E3FE8AC65AD4B484948F7796FEDC29BF4732E8C
                                                                                                                                                                                                                          SHA-256:0E2B011554E810F6BAEF95620F73A8BBF5BFF41AAAF3FFFAE7678E5EC1301293
                                                                                                                                                                                                                          SHA-512:64AFC70E4D6B2482B87A877D4A7E8E919FC614849F66ACBE4A7DF119BBAD1BD2C4A44D43FEE2ECE2E963195E6BFAA1F827386CF44970B18D4E1A9F57EA5A6EFE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD8B.tmp.dmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, CheckSum 0x00000004, Thu Jul 25 07:27:15 2024, 0x1205a4 type
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14180
                                                                                                                                                                                                                          Entropy (8bit):3.0830921661135724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:5dz841LJlzSkNyYXrwDPoYyXrlWw9LaFx1h2KE0kX2czNHtnudLPsstrTJVvzvrX:Q4tMYXqoxXIZELX2uDMVXOLhoP
                                                                                                                                                                                                                          MD5:16AE994699457129F3B4495147751263
                                                                                                                                                                                                                          SHA1:2C53D64A6A154D7C5AFB7C7AE00F5954370F6EB5
                                                                                                                                                                                                                          SHA-256:6D29DF00E6FCD7C3FEC7C586F61A807A3751B7E27C3F7F0DC9B84E2735569FE3
                                                                                                                                                                                                                          SHA-512:C45C24F2AD43EEDEB0B170A74A0ABC20DB4F3E5FABF8E620B436E91151C6F10C1760A034E16EF049E61D60AFBD944A841E3669FE58CCABDD1EA6CE55310E5BD8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MDMP..a..... .......S..f............4............!..<...........`7..........T.......8...........T................)...........*..........................................................................................eJ.......+......GenuineIntel..........T.......T...Q..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE77.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8306
                                                                                                                                                                                                                          Entropy (8bit):3.6851055222868485
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJ0J6e6YI96XCgmfSJsNCprq89beHJsfzYHm:R6lXJa6e6Yq6ygmfSJ60eHifsG
                                                                                                                                                                                                                          MD5:61878A967C1437CDCE52A4176BD2A95A
                                                                                                                                                                                                                          SHA1:7C0F786EC1E5693E9CF16856623D77415C60C8DB
                                                                                                                                                                                                                          SHA-256:E9D8EA2EA50980CFF80EA7469455C0E716EEF58D5BB9D58919820F6E1715B88C
                                                                                                                                                                                                                          SHA-512:752515A6F403AAC6CA2E399A90005CE880F23F396E50AD5B4E745E7FB2285281931D54D7879AFBDB683F987A57617BBDA1FFEAD3FE3AA79F12D81B21D8F8B26C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.2.8.<./.P.i.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEA7.tmp.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4733
                                                                                                                                                                                                                          Entropy (8bit):4.526863366121547
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zsTuJg77aI9wrWpW8VY8Ym8M4JLw6Y7fFVo+q8SU2GvOoJFyaOat3d:uIjfTkI76a7VsJLwTo7L6FyaOa5d
                                                                                                                                                                                                                          MD5:CBAF88ED3129883F645E38B5C3BEE140
                                                                                                                                                                                                                          SHA1:26B2595A026F8BC4172A5669EC9BBB7F7E8EB8E5
                                                                                                                                                                                                                          SHA-256:14276A2575092C1E684681462F460F4FF00A575AD91B1D6E22FF1802EF572DCD
                                                                                                                                                                                                                          SHA-512:BCDACD0B13E9F21BFEAA889CB46F4C60CB0D1E1486B9406FF45FF82931527C9A85BEBEFC35E7B3362B48C05FF917C8215926ADC2D20BD7EBC714A6FED4F06EF7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="426149" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERAECA.tmp.csv

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):90840
                                                                                                                                                                                                                          Entropy (8bit):3.1198818492273936
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:469T6SosutNNNe1KE5FSBw1Pb/F1t+J+b6+fgoW89SxQ:469T6SosutNNNe1KE5FSBw1Pb/F1t+Je
                                                                                                                                                                                                                          MD5:84E04EFBF9B057FAF4F6F4FCADBC248E
                                                                                                                                                                                                                          SHA1:EABCEDEDB65EA7DBFAA59FEF124BFBFCF0FFAC52
                                                                                                                                                                                                                          SHA-256:477402E523EE4743430F8DDC2E5ADF1F6B62A64B6821CFA8D18BFE93BF386192
                                                                                                                                                                                                                          SHA-512:2D1387578E2E73FA1B492691A7A77F1E69A6562BCE5FEC329AC0F69C217E5596C1328D95F58ABB0C3CD5E3E6BC8D110C0C3F8C940036BAD2A8A5DE3A0FD60DFB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF48.tmp.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13340
                                                                                                                                                                                                                          Entropy (8bit):2.6857807476479354
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:TiZYW+crG2zLHNYAYgAWlElWHrYEZn76tHi8VCsZw41zaz+FMwLzIqX3:2ZD+ON3Xw60paz+FMwL8qX3
                                                                                                                                                                                                                          MD5:F329B8843F1FA89A0D1B7800F81429D4
                                                                                                                                                                                                                          SHA1:122ED57682CF2A22B95214975D28E8365A98369A
                                                                                                                                                                                                                          SHA-256:330BBA1523EA19D47C3D427602A8F51018024EB2C1A1E8DBE900185297B48545
                                                                                                                                                                                                                          SHA-512:D597100D385CDBC340078601EF0F5C6AC00B1B8BC575B6B2FD8AE2F7F3B772FD9164231803531EAAB23AE256012717700512878CEFCFA68FE40A07B1F6D16849
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3E2.tmp.dmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, CheckSum 0x00000004, Thu Jul 25 07:27:21 2024, 0x1205a4 type
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24036
                                                                                                                                                                                                                          Entropy (8bit):2.8726354500563973
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:+SKMwX1TU2X2AhlfXX6Xk97kJIOLhg9+oey+5PXrEp:pAhl/6XWOPLC9+C+5zEp
                                                                                                                                                                                                                          MD5:E24EF48E0AF1C24A276BACCF27F466CA
                                                                                                                                                                                                                          SHA1:C28AE5D1942800A24E5FCDE985A04D0B51210F5E
                                                                                                                                                                                                                          SHA-256:E00865046AEDD5FD8960AF4A157602A21644D1330F33FE539FCD5262EB296A46
                                                                                                                                                                                                                          SHA-512:7D5ED8FF8DB95F4CFFC917A0EAAF94FE58F68696DA9D000B4547B389110D88C4B0C725E0FB36E76A41D94D42C704600128AF5F06C9C1B8ECB595A8D0C99AF03D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MDMP..a..... .......Y..f............4...........0"..<.......$....7..........T.......8...........T................I..........l)..........X+..............................................................................eJ.......+......GenuineIntel............T...........V..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERC47F.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8368
                                                                                                                                                                                                                          Entropy (8bit):3.6901911031826833
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJw/W6q6YIr63gmfnaJsNCpra89begKsfoYGm:R6lXJwO6q6Y863gmfnaJ6kegpfvv
                                                                                                                                                                                                                          MD5:DC08E69FCA8750A9308A31B790DEE7F6
                                                                                                                                                                                                                          SHA1:D3A2C04E9F2264FAAF80134E0A1244F2D757A690
                                                                                                                                                                                                                          SHA-256:5788FB7C05C1688723F3F4490E22544F68A3CF347F1D752527B9DFFC6B6396E5
                                                                                                                                                                                                                          SHA-512:1DCFC72892E33FB5033457AB4F90AB88EC3EF3AAEE8CAD401891A103DB856668629DFD8DBEF95E02EF5D87860537ECD34B0B4510B8C3A4BD5CD01CDCBFC15820
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.4.4.<./.P.i.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4A0.tmp.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4733
                                                                                                                                                                                                                          Entropy (8bit):4.523288422185638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zswtJg77aI9wrWpW8VYJYm8M4JTY7fFCj+q832GsoJnReR3d:uIjfwHI76a7VRJ1h6nR+d
                                                                                                                                                                                                                          MD5:26E2391C13369D2BCC6632712BEA9F0D
                                                                                                                                                                                                                          SHA1:1B1BA6132E96864D6A2850AC9BC09EF74C55627B
                                                                                                                                                                                                                          SHA-256:A4FE5501CB6CD6ECAEED1F38A3F158EA2757789CA8C01CF25CC286C44D797AE2
                                                                                                                                                                                                                          SHA-512:68AAFA70D27A4DBEC6B4B4C80CBBBE0B52E6AD95BBCF05FE8704F875213975EF266A84433B2437CBC215AAA15EA78A41F99C4FDBFBCFB989DAA9E3A31589F30D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="426150" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4D4.tmp.csv

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):91288
                                                                                                                                                                                                                          Entropy (8bit):3.1203124464092604
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:kLMZ+WzjjHLorO8xjsKE4LSBFPb/F1t+J+b6+fgo8F9mZS:kLMZ+WzjjHLorO8xjsKE4LSBFPb/F1t8
                                                                                                                                                                                                                          MD5:99E4439DD966CD01E9DCA87FA51A7538
                                                                                                                                                                                                                          SHA1:C9EBD670BFE36BC1F413900C1A9AB686327BED88
                                                                                                                                                                                                                          SHA-256:6651AB22C283B68AED99353141AE3A03DC0B3886ECD55CB42A9D577B083627C3
                                                                                                                                                                                                                          SHA-512:A051B140073A976BA32CD694FEB3F68108EB1AB828CF5DEA99FBAFD715FF143EA3C8A6E72E66D77002783FFC2CB5F4CD705CEDBB23595379785741027EAACD9D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5B0.tmp.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13340
                                                                                                                                                                                                                          Entropy (8bit):2.6859047104347034
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:TiZYWHd7YHIYgYNWfABHkYEZzmtHitVxsiwfNBlanJJiMOhAI3X3:2ZD6IndYhanJ8MOhX3X3
                                                                                                                                                                                                                          MD5:E96C99AB6B053E145B598014910EA8D1
                                                                                                                                                                                                                          SHA1:3A29A24A207B3E89AE9F898094BA029F65DA7797
                                                                                                                                                                                                                          SHA-256:7D6DF266C2AC61182EE03461BCC75AE975B6A69EF131282D775159CB25ABF6C0
                                                                                                                                                                                                                          SHA-512:0351F53CBBA6B8817275B62C06E2A957B3B60FA1299B1DDCF786186554C60D934C445AA1B012117DA7C1065E5161457C70BCFFB97BFA9CA640C70420D033EF52
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD806.tmp.dmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, CheckSum 0x00000004, Thu Jul 25 07:27:26 2024, 0x1205a4 type
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24036
                                                                                                                                                                                                                          Entropy (8bit):2.871591900177574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:pSQ8+MwX1TU2X2AhlfXX6XklOLhgEIebznqTwNVjIZ:kBAhl/6XJLCELzQwNVjIZ
                                                                                                                                                                                                                          MD5:9A04D21CBE3EAEB6A030D79CFB6F0085
                                                                                                                                                                                                                          SHA1:BD3AD83BB78D5F7F6A7BE063A2C351F7CE56EFAE
                                                                                                                                                                                                                          SHA-256:B08C778260874C5E1E202F7738DAC3EE5C486213AAF085C41F9A89BAC1810FD1
                                                                                                                                                                                                                          SHA-512:0EF993B157413B61EE5D07B88A71C694EC06480ADEACE65D420AED64D12FFCAE85B6B766F4EEA8B92CDD2D23FFE70D9A98338CA063AC0DA51BDDCDE252D449B5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MDMP..a..... .......^..f............4...........0"..<.......$....7..........T.......8...........T................I..........l)..........X+..............................................................................eJ.......+......GenuineIntel............T.......$...\..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD901.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8368
                                                                                                                                                                                                                          Entropy (8bit):3.686798027046893
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJuM6/c6YIK6AL1gmfYJsNCpra89be/isfyYvm:R6lXJl6k6Yd6AhgmfYJ6ke/hfBO
                                                                                                                                                                                                                          MD5:F6770779CEB08B0A3A0D937D3D7A8721
                                                                                                                                                                                                                          SHA1:6782F26194165EE9619ECFD998AD2A36F6462EA1
                                                                                                                                                                                                                          SHA-256:7800454C18EB410F93C520D677BAEC16DE78A7B9904345C6486D1376E3F6EEE0
                                                                                                                                                                                                                          SHA-512:7ACCDDC774DA44FAFBFF6C20E3FF97A2177459CB7C56E7C07AD27371F5A512271ABA466F0690DC1BC5CD70528022885D215934BC3C5ADA5AD29ECE2BF6107F13
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.1.3.2.<./.P.i.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD931.tmp.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4733
                                                                                                                                                                                                                          Entropy (8bit):4.513258642213325
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zswtJg77aI9wrWpW8VYdYm8M4JTY7fFvGn+q852GtZoJ17Y3d:uIjfwHI76a7VpJeGnI6174d
                                                                                                                                                                                                                          MD5:37B01DCF2F07F5C5F1EC8FC1951E62DA
                                                                                                                                                                                                                          SHA1:A54B77A437EFCA880DDB1EB3C0068E3E2C5610FA
                                                                                                                                                                                                                          SHA-256:23C789B2D6362A9DDC0E857E4CC53F7C949DCDBA542D99A155426CF80411B17D
                                                                                                                                                                                                                          SHA-512:02C2E0201230FE967F6DE667D35EB59AA5031DFA7043DB27B30CF1F54EC11CE5344FA8820D6AE34823527A7205B7BBDAC99ECC3D54FD6854DF5557F77C5D2FF0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="426150" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD968.tmp.csv

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):91210
                                                                                                                                                                                                                          Entropy (8bit):3.1200554545950006
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:qWS3DDe0/oJd8Y/cnKDzDSB/Hb/F1t+J+b6+fgoxB9Eh7RBV:qWS3DDe0/oJd8Y/cnKDzDSB/Hb/F1t+J
                                                                                                                                                                                                                          MD5:4F52DAB83F292A00AB4D8220EB5DF38F
                                                                                                                                                                                                                          SHA1:FC453F15E75FED40759114ACB50153DD108F5F1D
                                                                                                                                                                                                                          SHA-256:915301D7258E2AF11295416A88CD3FF3F1358EF19B41719B164F26C51FF15ADB
                                                                                                                                                                                                                          SHA-512:F22526A5CD83A0EB241F9BA5C737B97CB2424BF1607938B88C0B61EA3417C33F7CA116DAC64B1236E04DB7ACA9C1AEDD5A7CF3E70A1E65D03686049956DDBFD6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9E6.tmp.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13340
                                                                                                                                                                                                                          Entropy (8bit):2.6879689204934816
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:TiZYWnzi3psFH2gYtY+W/k1HKYEZNgtHiZVoxs9wgDeBaSYt6Mb+8I6h3:2ZDnLXK4fqaSYQMb+76h3
                                                                                                                                                                                                                          MD5:BE49348B771BCF29B9D7BC4C1304A854
                                                                                                                                                                                                                          SHA1:FB57E643F4771AF4D0C40039DEE17DF1202EDEE6
                                                                                                                                                                                                                          SHA-256:11A462AD3057B228A786153134AF7E2F2A5F9328E46E5C60D6FD7312C7091C23
                                                                                                                                                                                                                          SHA-512:ECB6234F0B372CD4F8544C552E26A6675F9ABC3E5B9566A520567326435E90BAC831A3F5665D4A711ADED0C76E699335BBC50850E9DA3FFCFF38F158347F15AF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                          C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.3dc4f583-c3e7-45cf-bd56-4b3ac4d9ed20.1.etl

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4096
                                                                                                                                                                                                                          Entropy (8bit):1.1872035404208596
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:DjqPqF69Fq5j9hk56GWtbgjO3s7Nxk56G4ROFWQlysFN:Dc12Gtm2jGtkODzFN
                                                                                                                                                                                                                          MD5:83CFD2D9183138ACE8698B652DA0EC19
                                                                                                                                                                                                                          SHA1:E80029E575F3F02293B4388A21D417FC30FDE159
                                                                                                                                                                                                                          SHA-256:216ADFB0BE1B5523CDF08ACF3F97B35A6BBEEBF9329F58A3F056BE48A96D9C84
                                                                                                                                                                                                                          SHA-512:51D383DA760191610152913A6A61EC092D41F5E049CCE10F3E7C775ABAA4DA19EB59E9C0CD82351A75BC8AFC9AFAC475E9AFBA8E3B376589CE765D1BEB015468
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:............................................................................D...0...........W...................eJ..............Zb..K....(......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................H8.T...............W...........U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.S.y.s.t.e.m.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...3.d.c.4.f.5.8.3.-.c.3.e.7.-.4.5.c.f.-.b.d.5.6.-.4.b.3.a.c.4.d.9.e.d.2.0...1...e.t.l...........P.P.0...........W...................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):999
                                                                                                                                                                                                                          Entropy (8bit):4.966299883488245
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
                                                                                                                                                                                                                          MD5:24567B9212F806F6E3E27CDEB07728C0
                                                                                                                                                                                                                          SHA1:371AE77042FFF52327BF4B929495D5603404107D
                                                                                                                                                                                                                          SHA-256:82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
                                                                                                                                                                                                                          SHA-512:5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

                                                                                                                                                                                                                          C:\Users\user~1\AppData\Local\Temp\!@t65A5.tmp (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 654 bytes, 1 file, at 0x2c +A "setup.ini", number 1, 1 datablock, 0x1 compression
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):654
                                                                                                                                                                                                                          Entropy (8bit):7.51650500462454
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:w5tr+Mvdx/e7SdReCBWhgzQDMo78Oe536Ir44RGyjND:wlviGC7husBe5qk44RX
                                                                                                                                                                                                                          MD5:4E1C02465CE0D7E70D5DDA7E5C30A387
                                                                                                                                                                                                                          SHA1:488AF13A865E5FE8CFC76D638B2F44EF0F662441
                                                                                                                                                                                                                          SHA-256:2225BB63D8FD596D07B2858DC01997E76EF4E83E6283E3CABEEEA21947C90E97
                                                                                                                                                                                                                          SHA-512:3E4A75F9B3CF3C0F46BE9A313B2D20C56DC3104B11ADA8928BA6342D737A5D2B20E8712B645777DBD0319DBA318468877F1065696159DD572AA4B56A9C195434
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MSCF............,...................F.......>..........X.u .setup.ini.H1..@.>.CKMR.j.0.|7...}Ott....]I.m.&..,!....N..v...=N[..A>....g&.j...X...dZ.v.m.c...I.<_W.s.~+..MqB...^.C..&q.?.y.^.i......._.Pir.E<.K.Z!M.!JO9.NK.(3.I....4....|...}>...V.&..Z..7..n>......a[...K.|<T...f..u]V.%...,..a4_..E.~..../~......w.u.w.?..o.;...R....r..pCs .Q..wg.3..).^.C..A8...0......"B.n.rN.3.A..m.5.>.\ooo..._.bUL.l...b6........-....a0...."t.,..F........U;...........O......#.....^+T\.5.9.r}...p....K....q...)'........;<..+o3.S<.N.K.Y."..aT.".f.q.(...h#.(e-G.`.3......nT.f.k..Q..2..(RX.Y....x@sArA.. ..JH..V... .q!...G......<6a..tG...9g..

                                                                                                                                                                                                                          C:\Users\user~1\AppData\Local\Temp\!@tFC09.tmp (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe
                                                                                                                                                                                                                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 654 bytes, 1 file, at 0x2c +A "setup.ini", number 1, 1 datablock, 0x1 compression
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):654
                                                                                                                                                                                                                          Entropy (8bit):7.51650500462454
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:w5tr+Mvdx/e7SdReCBWhgzQDMo78Oe536Ir44RGyjND:wlviGC7husBe5qk44RX
                                                                                                                                                                                                                          MD5:4E1C02465CE0D7E70D5DDA7E5C30A387
                                                                                                                                                                                                                          SHA1:488AF13A865E5FE8CFC76D638B2F44EF0F662441
                                                                                                                                                                                                                          SHA-256:2225BB63D8FD596D07B2858DC01997E76EF4E83E6283E3CABEEEA21947C90E97
                                                                                                                                                                                                                          SHA-512:3E4A75F9B3CF3C0F46BE9A313B2D20C56DC3104B11ADA8928BA6342D737A5D2B20E8712B645777DBD0319DBA318468877F1065696159DD572AA4B56A9C195434
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MSCF............,...................F.......>..........X.u .setup.ini.H1..@.>.CKMR.j.0.|7...}Ott....]I.m.&..,!....N..v...=N[..A>....g&.j...X...dZ.v.m.c...I.<_W.s.~+..MqB...^.C..&q.?.y.^.i......._.Pir.E<.K.Z!M.!JO9.NK.(3.I....4....|...}>...V.&..Z..7..n>......a[...K.|<T...f..u]V.%...,..a4_..E.~..../~......w.u.w.?..o.;...R....r..pCs .Q..wg.3..).^.C..A8...0......"B.n.rN.3.A..m.5.>.\ooo..._.bUL.l...b6........-....a0...."t.,..F........U;...........O......#.....^+T\.5.9.r}...p....K....q...)'........;<..+o3.S<.N.K.Y."..aT.".f.q.(...h#.(e-G.`.3......nT.f.k..Q..2..(RX.Y....x@sArA.. ..JH..V... .q!...G......<6a..tG...9g..

                                                                                                                                                                                                                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4770
                                                                                                                                                                                                                          Entropy (8bit):7.946747821604857
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
                                                                                                                                                                                                                          MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
                                                                                                                                                                                                                          SHA1:719C37C320F518AC168C86723724891950911CEA
                                                                                                                                                                                                                          SHA-256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
                                                                                                                                                                                                                          SHA-512:02F88DA4B610678C31664609BCFA9D61DB8D0B0617649981AF948F670F41A6207B4EC19FECCE7385A24E0C609CBBF3F2B79A8ACAF09A03C2C432CC4DCE75E9DB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MSCF............,...................O.................2Wqh .disallowedcert.stl....^K...CK.wTS...:.w.K'.C0T.....Bh.{....C.).*.....Y@...(..).R."E..D^6........u....|f~3...o.3. ..SPK.k.o#...."{-.U..P........:..aPr.@.d......Dy.h.....)..:...!./\A.....A<I_<$...q.h..........'.....7....H...@`T..K.S.%...Y4..R.....`.....-....D...(..b..-c."...G.=.dx..S+..2.a.E....d.L...77J...c.[..@..iT&..^78..g....NW6.Ek..FY.F........cNt.O.*..R....*......D...... k........J.y...z.d...;.9_t...].@....yw..}.x....d.t..`f\K..;|.*h.X...4/.;.xT......q>.0...<...3...X..L$.&.,b.....\V....\......G..O..@..H3.....t..J..).x.?.{[..G>.7...<...^Q..z..Gw9P..d....i].n%K}.*z..2.Py...A..s...z..@...4..........4.....*Y.d..._Z.5.s..fl.C..#.K{9^.E...k..z.Ma..G.(.....5g. ...}.t.#4....$;.,....S@fs....k......u .^2.#_...I........;.......w..P...UCY...$;.S._|.x..dK...[i..q..^.l..A.?.....'N.. .L.l......m.*.+f#]............A.;.....Z..rIt....RW....Kr1e=8.=.z:Oi.z.d..r..C_......o...]j.N;.s....3@3.dgrv.

                                                                                                                                                                                                                          C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:modified
                                                                                                                                                                                                                          Size (bytes):338
                                                                                                                                                                                                                          Entropy (8bit):3.2760409958454813
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:kK72jsN+SkQlPlEGYRMY9z+s3Ql2DUevat:z2jTkPlE99SCQl2DUevat
                                                                                                                                                                                                                          MD5:978ECCBF78F18B3859A6F18857FB1581
                                                                                                                                                                                                                          SHA1:DCF1B0B986C11349E3D8042A7A9F6CFC17721F7A
                                                                                                                                                                                                                          SHA-256:8E388EB268C680E7C347B0BFDE4688AF14565C1ECD4533678665A95D1C191705
                                                                                                                                                                                                                          SHA-512:50AE63A79D725F8AD4D0B5BEF9F9DB2FE128B9A75523C425863FC6153E9D80756AC43446C62D50261BD8691A49218CC07EE5C240A8EE3C72A721A403E6C2621B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:p...... .........I..W...(....................................................... .........p.........$.....(=........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\0lzVim7riCB1upr1FUP8xSQR.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\0tKUigrv8FZlFjBm6o7EVBkc.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\1IZVL6x1EXi1l4x68y4gFu3H.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\2tcX737WHyo5lwEvmctv51Vv.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\36dsvh9ycgNnqmR2ByFaAF5L.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\3DN5iaTYoSMvSYVEgNVq6srw.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\3pU7us2lCosxu8OuPe4BpnIe.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\4ZZwfXAuJ072C1VqOfz1A4ih.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\5xh1kzRK1sY56wRtA0VfLbHM.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\6Se9cfVvgkgQ1LiWk4azwLiz.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\6l2OHZVq9ozMIVBLr01xSPSn.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\6zadM3w0LYJNq0HAyB6c8Jvg.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\7TZg7zlWDNnbBmFYTmmvpQh2.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\8gHZdIpZQLlZm3sIFx1QuBpo.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\9fMPr9bjofOW56waLjTgg4fo.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\BYMTdmumqdQRWdqfOhAEZ4m7.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\C5Kjr9aaz6hDS52NkOqq8y55.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\CHlvcwjKXoNvEPi7AbbOuC76.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\CUxLCA8x4ghROFTMPdaQB3M5.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\CXuRBddRChUEwLDDTAGzBHG0.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\DZN9HaS2r82y90oqcDIGvbua.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Et3mnRfmuPQFakro2oc74eeS.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Ij1WDhMqibF1B2QU9vGntIlT.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\K8xiKDxfY6nPxIYPlvgH1pTk.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Lqzz8bYqWlL5siF3Zd6Xfpqn.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\N4T8qP0zIsmhNbok9EeYkn9g.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\NPEDxjpZoYrdEERzjiUZxi6O.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\OwwOgzkPQh7uMioCPDE28dVh.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\PT6Mx7KioNvzBAtCL7QX2GXq.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Qs8gKU4lVOLm6RixkxRfa4V2.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\RYKhEanOwC6FWik4A4mJOAN8.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\SXah3THn9M8VoE65mbOGcxLZ.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\!@t65A5.tmp.P2P

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 654 bytes, 1 file, at 0x2c +A "setup.ini", number 1, 1 datablock, 0x1 compression
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):654
                                                                                                                                                                                                                          Entropy (8bit):7.51650500462454
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:w5tr+Mvdx/e7SdReCBWhgzQDMo78Oe536Ir44RGyjND:wlviGC7husBe5qk44RX
                                                                                                                                                                                                                          MD5:4E1C02465CE0D7E70D5DDA7E5C30A387
                                                                                                                                                                                                                          SHA1:488AF13A865E5FE8CFC76D638B2F44EF0F662441
                                                                                                                                                                                                                          SHA-256:2225BB63D8FD596D07B2858DC01997E76EF4E83E6283E3CABEEEA21947C90E97
                                                                                                                                                                                                                          SHA-512:3E4A75F9B3CF3C0F46BE9A313B2D20C56DC3104B11ADA8928BA6342D737A5D2B20E8712B645777DBD0319DBA318468877F1065696159DD572AA4B56A9C195434
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MSCF............,...................F.......>..........X.u .setup.ini.H1..@.>.CKMR.j.0.|7...}Ott....]I.m.&..,!....N..v...=N[..A>....g&.j...X...dZ.v.m.c...I.<_W.s.~+..MqB...^.C..&q.?.y.^.i......._.Pir.E<.K.Z!M.!JO9.NK.(3.I....4....|...}>...V.&..Z..7..n>......a[...K.|<T...f..u]V.%...,..a4_..E.~..../~......w.u.w.?..o.;...R....r..pCs .Q..wg.3..).^.C..A8...0......"B.n.rN.3.A..m.5.>.\ooo..._.bUL.l...b6........-....a0...."t.,..F........U;...........O......#.....^+T\.5.9.r}...p....K....q...)'........;<..+o3.S<.N.K.Y."..aT.".f.q.(...h#.(e-G.`.3......nT.f.k..Q..2..(RX.Y....x@sArA.. ..JH..V... .q!...G......<6a..tG...9g..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\!@t65A5.tmp.dir\setup.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                          File Type:Generic INItialization configuration [360TS]
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):830
                                                                                                                                                                                                                          Entropy (8bit):5.595816271877722
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:9L9A9zAoVWqa7WdYPN9zXiyAVVAN82g/GAM35:9LuGolSRjAsN8JeAk5
                                                                                                                                                                                                                          MD5:14BD5E917253C098F5DA32F0CE1A7D8A
                                                                                                                                                                                                                          SHA1:E91921B1D91245082CCD67A652C9C937DDE386A4
                                                                                                                                                                                                                          SHA-256:D167849F223C64DF2CF30E9B98D5E2C6AD1FC14EDE3C012C20F14FEE883E0C90
                                                                                                                                                                                                                          SHA-512:7CAB5009A9FB74497BEF847BEE8AF1AE33717DF857D19561CC7EAE0AAC5176F57489B6E6CCC986E3FEB581328B0C7D102956E047E55DCE6B9BF9852C7F063A7D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:[360Installer]..Product=360TS....[360TS]..Name=360 Total Security..FID=360TS_Setup..Version=11.0.0.1118..MD5FileID=B56AE4EF6D244BC96CE23A140FF0411E..RegAppPath=HKEY_LOCAL_MACHINE|SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\QHSafeTray.exe|Path..RegAppEntry=QhSafeTray.exe..RegVersionFile=QHVer.dll..urls=pdown://b2=104329184|p2=38F1C812D5EA025FE5C1121AA32707BEAED8059B|h3=40|p4=1800|b5=360TotalSecurity###PRODUCT_TOTAL_SECURITY|b6=Update###DESC_MAINUPDATE|b7=5|b9=1|http://int.down.360safe.com/totalsecurity/360TS_Setup_11.0.0.1118.exe....[360signdata]..sign=0100000053B31B5638F89CD669EA1E745FAD9178C5A44B129973204C00031D8DB7D42C847EC9EB21CB58F3750326E05593A34C8207AD48A9A61088BB4FADEA5CAA1685AF37F89F86B74D92DD92FF91C77CC66724C8BD92B5F0528AD1A1EE6450DA5157326B856DDCC9B8BFFC50EC455385FDF146196FFC5886BD299B8D10550E6223CCBC

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\!@tFC09.tmp.P2P

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe
                                                                                                                                                                                                                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 654 bytes, 1 file, at 0x2c +A "setup.ini", number 1, 1 datablock, 0x1 compression
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):654
                                                                                                                                                                                                                          Entropy (8bit):7.51650500462454
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:w5tr+Mvdx/e7SdReCBWhgzQDMo78Oe536Ir44RGyjND:wlviGC7husBe5qk44RX
                                                                                                                                                                                                                          MD5:4E1C02465CE0D7E70D5DDA7E5C30A387
                                                                                                                                                                                                                          SHA1:488AF13A865E5FE8CFC76D638B2F44EF0F662441
                                                                                                                                                                                                                          SHA-256:2225BB63D8FD596D07B2858DC01997E76EF4E83E6283E3CABEEEA21947C90E97
                                                                                                                                                                                                                          SHA-512:3E4A75F9B3CF3C0F46BE9A313B2D20C56DC3104B11ADA8928BA6342D737A5D2B20E8712B645777DBD0319DBA318468877F1065696159DD572AA4B56A9C195434
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MSCF............,...................F.......>..........X.u .setup.ini.H1..@.>.CKMR.j.0.|7...}Ott....]I.m.&..,!....N..v...=N[..A>....g&.j...X...dZ.v.m.c...I.<_W.s.~+..MqB...^.C..&q.?.y.^.i......._.Pir.E<.K.Z!M.!JO9.NK.(3.I....4....|...}>...V.&..Z..7..n>......a[...K.|<T...f..u]V.%...,..a4_..E.~..../~......w.u.w.?..o.;...R....r..pCs .Q..wg.3..).^.C..A8...0......"B.n.rN.3.A..m.5.>.\ooo..._.bUL.l...b6........-....a0...."t.,..F........U;...........O......#.....^+T\.5.9.r}...p....K....q...)'........;<..+o3.S<.N.K.Y."..aT.".f.q.(...h#.(e-G.`.3......nT.f.k..Q..2..(RX.Y....x@sArA.. ..JH..V... .q!...G......<6a..tG...9g..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\!@tFC09.tmp.dir\setup.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe
                                                                                                                                                                                                                          File Type:Generic INItialization configuration [360TS]
                                                                                                                                                                                                                          Category:modified
                                                                                                                                                                                                                          Size (bytes):830
                                                                                                                                                                                                                          Entropy (8bit):5.595816271877722
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:9L9A9zAoVWqa7WdYPN9zXiyAVVAN82g/GAM35:9LuGolSRjAsN8JeAk5
                                                                                                                                                                                                                          MD5:14BD5E917253C098F5DA32F0CE1A7D8A
                                                                                                                                                                                                                          SHA1:E91921B1D91245082CCD67A652C9C937DDE386A4
                                                                                                                                                                                                                          SHA-256:D167849F223C64DF2CF30E9B98D5E2C6AD1FC14EDE3C012C20F14FEE883E0C90
                                                                                                                                                                                                                          SHA-512:7CAB5009A9FB74497BEF847BEE8AF1AE33717DF857D19561CC7EAE0AAC5176F57489B6E6CCC986E3FEB581328B0C7D102956E047E55DCE6B9BF9852C7F063A7D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:[360Installer]..Product=360TS....[360TS]..Name=360 Total Security..FID=360TS_Setup..Version=11.0.0.1118..MD5FileID=B56AE4EF6D244BC96CE23A140FF0411E..RegAppPath=HKEY_LOCAL_MACHINE|SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\QHSafeTray.exe|Path..RegAppEntry=QhSafeTray.exe..RegVersionFile=QHVer.dll..urls=pdown://b2=104329184|p2=38F1C812D5EA025FE5C1121AA32707BEAED8059B|h3=40|p4=1800|b5=360TotalSecurity###PRODUCT_TOTAL_SECURITY|b6=Update###DESC_MAINUPDATE|b7=5|b9=1|http://int.down.360safe.com/totalsecurity/360TS_Setup_11.0.0.1118.exe....[360signdata]..sign=0100000053B31B5638F89CD669EA1E745FAD9178C5A44B129973204C00031D8DB7D42C847EC9EB21CB58F3750326E05593A34C8207AD48A9A61088BB4FADEA5CAA1685AF37F89F86B74D92DD92FF91C77CC66724C8BD92B5F0528AD1A1EE6450DA5157326B856DDCC9B8BFFC50EC455385FDF146196FFC5886BD299B8D10550E6223CCBC

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\1721892447_00000000_base\360base.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1061608
                                                                                                                                                                                                                          Entropy (8bit):6.710212792740735
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:g2mj42MEVQPGEorkSYPuX/7DkbSrh/qtoT/cgB8SnLF:2jnMEVQuFkS/vkurNqtoTkgCSnJ
                                                                                                                                                                                                                          MD5:B192F34D99421DC3207F2328FFE62BD0
                                                                                                                                                                                                                          SHA1:E4BBBBA20D05515678922371EA787B39F064CD2C
                                                                                                                                                                                                                          SHA-256:58F13D919F44D194827B609B6B267246ABC47134BB202472C0DFE033B9D7ED73
                                                                                                                                                                                                                          SHA-512:00D4C7A0A0097EB4B31A71A0EAF6FF0D44619F77A335C75688565E34E6D7F4FB6C258917457D560C6B0A5077603845CE012E01D9862E87FB5327D7F8DA970F95
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.........s.............Nk.....Nk.\...Nk.....1......._......._.......................dW.................................................................o.......R.......R.......R..............R.......Rich............................PE..L....E.d...........!.........j...............................................`.......3....@..........................7......h8..........................P,..........Pw..T............................w..@...............L............................text............................... ..`.rdata...k.......l..................@..@.data....]...P...(...<..............@....rsrc................d..............@..@.reloc...............j..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Base.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1061608
                                                                                                                                                                                                                          Entropy (8bit):6.710212792740735
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:g2mj42MEVQPGEorkSYPuX/7DkbSrh/qtoT/cgB8SnLF:2jnMEVQuFkS/vkurNqtoTkgCSnJ
                                                                                                                                                                                                                          MD5:B192F34D99421DC3207F2328FFE62BD0
                                                                                                                                                                                                                          SHA1:E4BBBBA20D05515678922371EA787B39F064CD2C
                                                                                                                                                                                                                          SHA-256:58F13D919F44D194827B609B6B267246ABC47134BB202472C0DFE033B9D7ED73
                                                                                                                                                                                                                          SHA-512:00D4C7A0A0097EB4B31A71A0EAF6FF0D44619F77A335C75688565E34E6D7F4FB6C258917457D560C6B0A5077603845CE012E01D9862E87FB5327D7F8DA970F95
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.........s.............Nk.....Nk.\...Nk.....1......._......._.......................dW.................................................................o.......R.......R.......R..............R.......Rich............................PE..L....E.d...........!.........j...............................................`.......3....@..........................7......h8..........................P,..........Pw..T............................w..@...............L............................text............................... ..`.rdata...k.......l..................@..@.data....]...P...(...<..............@....rsrc................d..............@..@.reloc...............j..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Base64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1301168
                                                                                                                                                                                                                          Entropy (8bit):6.478229662969352
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:kGtlqC59JiWdmE6r7DzyIzcRIfBFEUT62a3muq9Y+Hk3BRyTTAg521LSYyk9z:kGtlqs9JiWdtwBFjT62aSdHk3STTYv
                                                                                                                                                                                                                          MD5:115BA98B5ABE21C4A9124DDA8995D834
                                                                                                                                                                                                                          SHA1:5DD5CAE213A9DBE5EA7729C1D2ACD080F75CFA39
                                                                                                                                                                                                                          SHA-256:80765ADB886050B0F87E30FA62336985DB67C09B25F4D1760194A28FF78899D7
                                                                                                                                                                                                                          SHA-512:1C415C07DD59EF00C7BDCEF35AC8FDEEA88B6F482D266CC12BAB3D4D3005A76EEBBE97D06E5282E1DBE940AB2971FFDCBD0DB2CD1D700C33805CF1831EFE1A3D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.........5.K.[@K.[@K.[@...@F.[@...@.[@...@k.[@.._AA.[@.._AB.[@..XAB.[@K.[@A.[@-._A..[@.._Aj.[@..^Au.[@B..@J.[@B..@I.[@B..@V.[@K.Z@..[@..XAJ.[@..^AJ.[@..^AJ.[@..RA..[@..[AJ.[@..@J.[@K..@J.[@..YAJ.[@RichK.[@........................PE..d...X..`.........." .....*..........(................................................}....`.........................................`...`....................0...........B..........0?..T............................?...............@..@............................text...T).......*.................. ..`.rdata.......@......................@..@.data....K..........................@....pdata.......0......................@..@.rsrc................`..............@..@.reloc...........0...f..............@..B................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Central.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2202208
                                                                                                                                                                                                                          Entropy (8bit):6.473214081008827
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:OBBkrG6xbn0toeeZNIPwG9NdJNGMyt6ptVXJRu8PUSVLX8n1EPaHutt7/MTzxI3:KV6xT0GeB9Xy1EPaH47WzI
                                                                                                                                                                                                                          MD5:DF3015F6E4A57C482D1D4CF95E8B490E
                                                                                                                                                                                                                          SHA1:36F7E3BF6A8E525DF2E2FADA809D2DC3779763FD
                                                                                                                                                                                                                          SHA-256:389B50F3A5D238AB704BA2626F045AB1DFFCF7812FE8700B606D0878D2B0E6B9
                                                                                                                                                                                                                          SHA-512:6CCA574545ED62B0E703B9AF5C7F30E84D9D546A464832A7CD3314835EA9AC99481A065DF3E8C84BA5BEAF7E4FC64896A22CCEE41CF73A6766188AEDA6C659B3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........f..l...l...l..d#...l.......l...>...l.......l....e..l.......l...l...n....s..l....f..l......ql...>...l.......l..Rich.l..........................PE..L....g.Y.................(...6...............@....@...........................!.....y.!...@.................................t...h....................d!..5.... ......I......................x.......0...@............@...............................text...p&.......(.................. ..`.rdata..x....@.......,..............@..@.data...\........l..................@....tls.................L..............@....rsrc................N..............@..@.reloc..*m.... ..n..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Common.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):340392
                                                                                                                                                                                                                          Entropy (8bit):6.276944652339594
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:jO0iCjQpBzY1ZydoXKOrBUhuLbTLQCjP4ca5C0B4rH6yHOUG5I6LfBWeHTQq5yA1:jJljzyOPrx7djP2CjrlrGJJa1wAo
                                                                                                                                                                                                                          MD5:B558000EB8730175EF241A108A4C437F
                                                                                                                                                                                                                          SHA1:F47854265B8138A58A6E623930D4F5F76DCD276F
                                                                                                                                                                                                                          SHA-256:1A062A0556BDF9579507C89B2F1B6D00B725800284EB9024DDE736C876E62AE1
                                                                                                                                                                                                                          SHA-512:6ADACF4B3CDB38B091FD23FB8302B2ADF8980D67338BD2FB00A111C60D31CFB7353B66154C46B007AD222C781446D0BDB5EAF5E14C03E50E2F729A15007A3699
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G...............................................$................X.......................Rich...................PE..L...g.gW...........!.....L...................`...............................`............@..........................6......|#...........................5.......2..pf..............................`...@............`...............................text....K.......L.................. ..`.rdata.......`.......P..............@..@.data...\....@...z...,..............@....rsrc...............................@..@.reloc..^I.......J..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Conf.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):301152
                                                                                                                                                                                                                          Entropy (8bit):6.59301561926313
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:ZT+U3PPxMBToCpGnKDa+VNdTTtVhl9GZcAHQO0MzUfPR/IVxOEvWTBfd7ZnYX1m2:BZt1+l/h2cv71fBIaEvWTBFz9RR6
                                                                                                                                                                                                                          MD5:B98A1E65F209FE1F10F8564DEC0F0C42
                                                                                                                                                                                                                          SHA1:CAB41605D9B7241C134798723ECDF9D3DC2F2615
                                                                                                                                                                                                                          SHA-256:885AA4F58297382396717563137D212FBCB4299F95426C40C43ABCDCECF54246
                                                                                                                                                                                                                          SHA-512:35CD81AAA9FBADB8B174F6B2D30FA6C2C0C91786E6714073598CB09F1028790F03609DE63B51C2E966021BD7DA8521EC06612F0582FC1A5752EE0DF7B8259B59
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x............!................................*{......*m...................................................Rich............................PE..L.....AZ...........!.........R............... .......................................g....@......................... ...K............P...............b...5...`...1..`".................................@............ ...............................text............................... ..`.rdata..k.... ......................@..@.data...|<..........................@....rsrc........P......................@..@.reloc...E...`...F..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360DeskAna.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):228920
                                                                                                                                                                                                                          Entropy (8bit):6.588902317739037
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:78oAPH6BdWT0N7JdQ8oH4SefaqNxTQPBFMmNWU4k/uwgUo9Bpqc8rz3nYDddyj9:CvdO1dQ8JxsPBhuwQq7Y09
                                                                                                                                                                                                                          MD5:9C914DA5BA91EC1854EFFA03C4EF6B27
                                                                                                                                                                                                                          SHA1:A2DFC7D70B5FEDC961B0BC6126962139BC848EA3
                                                                                                                                                                                                                          SHA-256:F78EEE64134AA2FCA1D6EECAA8AD2C3BF9E54C232554525AC4783768DAA677E1
                                                                                                                                                                                                                          SHA-512:266EFE7361A4226A5FCF81FD11AE96F7131E8911ADF6955423BF054D825C210B634BD1A2AC2F112C5B85FDA9AA1B9CA07E3646179BF9977724BC5B4E9E7DCA42
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........=O..\!..\!..\!.`. ..\!..4%..\!..4"..\!..:%..\!..:$..\!.Y5 ..\!..1$..\!..$...\!._...\!.V5%..\!.V5$..\!..:'..\!..;$..\!..;%..\!.Y5%..\!.Y5$..\!..4$..\!..: ..\!..\ ..]!._5(..\!._5..\!..\...\!._5#..\!.Rich.\!.........PE..L...:..^.................8..........P<.......P....@..................................`....@.....................................,.......8Q...........B...;...`..........p...........................p...@............P...............................text....6.......8.................. ..`.rdata...w...P...x...<..............@..@.data...`(....... ..................@....rsrc...8Q.......R..................@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360DeskAna64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):222264
                                                                                                                                                                                                                          Entropy (8bit):6.34289287185661
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:MB1yXwSGX9Iu1NPDnmyIkGX91y1Wh3m7OaZBPvJrz3nYu9I:MB1uW1RDnmQoHyJC2ldYu9
                                                                                                                                                                                                                          MD5:4B26B4B4F38FEE644BACCEFC81716C6C
                                                                                                                                                                                                                          SHA1:6036D5F882E7E189859E58FBBD4421A2B09B58DC
                                                                                                                                                                                                                          SHA-256:48B9596B3C7B1AF2C0C5CD62A815F7E43DEAC03AE3E91DA26E8DEC2891C915BE
                                                                                                                                                                                                                          SHA-512:76D2235E29A906C8973374D2EC3CB549222D431695DAF6CEDA2AAEEE95FD5BB35DD57D53A73D9A7BE04FE38D10F81EEE398BB81BF3C104BD0FC17E871D081A60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........1..._.._.._..K..._.7.^.._..\.._..[.._..Z.._..[.._...^.._..Z.._...[.._...Z.._...[.._..Y.._..Z.._..[.._...Z.._..Z.._..^.._..^..._...V.._......_....._...].._.Rich.._.................PE..d...F..^..........".......... ......0 .........@.............................p............`.............................................................8Q...........(...;...`..H...P]..p....................^..(....]............... ..(............................text...h........................... ..`.rdata....... ......................@..@.data...X+......."..................@....pdata..............................@..@.rsrc...8Q.......R..................@..@.reloc..H....`.......$..............@..B........................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360NetBase.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1448448
                                                                                                                                                                                                                          Entropy (8bit):6.806050829993881
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:mAWxXgDTLtuxkPkoAGb+KpPderMvDjQIuL/w1MJD3ndPKrlL6p/nxoMki+22:NWxkTLtyNojf1LvJgVBndM0p/gi+22
                                                                                                                                                                                                                          MD5:14C6B4BBD31F6FD13530BC941CC71D1A
                                                                                                                                                                                                                          SHA1:CE4E38AC82A54F64D318507DDC28F9FFBB378F0F
                                                                                                                                                                                                                          SHA-256:401D8529A84F1D80A439BE8CD4E869202162458E5AFB5E5BAC97C4859BFE8EB5
                                                                                                                                                                                                                          SHA-512:C16D525F1D3FC098B4D6C8B8A872A9013EF2F945F27AF73ED7826F61A2B80D756AE5348105432909ECCC71F03834CD1301F87FA5A0107E0C7137F5C8E3A3CC95
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&...H...H...H.y.....H......H...H...H......H...I...H...3...H....+.H.....H......H......H.......H......H.Rich..H.........................PE..L......\...........!......................... ...............................p............@.........................0\..J....L.......p..................h7......$....#..............................(6..@............ ...............................text...|........................... ..`.rdata..z<... ...>..................@..@.data...d....`.......L..............@....rsrc........p......................@..@.reloc..R...........................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360NetBase64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2307392
                                                                                                                                                                                                                          Entropy (8bit):6.716119116612393
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:CVIinTTBzBAr/XjSULaGtlq+1VwASOczhrzEIU6ii/CUP3w:CmvYD+i/Cow
                                                                                                                                                                                                                          MD5:869470FF4D2D3DFFC2EF004A208FA4AC
                                                                                                                                                                                                                          SHA1:98B2E5B7240567B046B47021E98C84702A39347A
                                                                                                                                                                                                                          SHA-256:AB52FFF1840B010A1E6BE5E432C44CA0AA2857D5DA3DF6574FC0FBC0004EDC7A
                                                                                                                                                                                                                          SHA-512:F7994F656FC52D5C9FF24D7746D7B36DA6A749BDFEB06A24B17CB762E50BFF1FBC9F4AE3E4EC884B81776905C870E70CD8FE326B2F3D21A3D1A866B274F369E2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].................n.......m...............q.....>&................{.......|.W.....j.......l.......o.......i.....Rich............PE..d......\.........." .....(...,.......h........................................#.......#...@.............................................L.............#......."......."..B... #.|O...P...............................................@..`............................text....'.......(.................. ..`.rdata......@.......,..............@..@.data...............................@....pdata........"......z!.............@..@.rsrc.........#.......".............@..@.reloc...c... #..d....".............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360NetUL.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):245344
                                                                                                                                                                                                                          Entropy (8bit):6.733828164089079
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:qVnmVCxQaQLqoHwkxw3SThfLo9TBlTIioUaC:qVmkxQaQLqwxwCJo9TjKC
                                                                                                                                                                                                                          MD5:2586F41ADFBA6687E18E52B75F69C839
                                                                                                                                                                                                                          SHA1:88D1099AFD28ED6C3943107904DC766BB509EC40
                                                                                                                                                                                                                          SHA-256:E692BB1CABB48BD7652F7FCC17C10F0C421304677128E199347CA54C75340CE5
                                                                                                                                                                                                                          SHA-512:B16BD522FD69F8190362E4003513CB0401544A5C89BEE6B5EAA569E2262E88F405D9C84425B3CB1AFD74B3D2771062E37E7AC367246CA69686C8414632A17F06
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r.i...:...:...:.k]:...:.kK:...:.kA:...:..:...:...:P..:.kL:...:.kZ:...:.A\:...:.kY:...:Rich...:........PE..L...c..Z...........!......................................................................@..........................C.......3..........\................5.......... ...................................@............................................text.............................. ..`.rdata..,...........................@..@.data...|E...P.......4..............@....rsrc...\............P..............@..@.reloc...,...........X..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360P2SP.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):823296
                                                                                                                                                                                                                          Entropy (8bit):6.544928617725756
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:JBilJtWo6fWqxNflfY3orK1B+AFD63fA9TxD/:+4NfVY3oZY23fqTxD/
                                                                                                                                                                                                                          MD5:B9BEE9E7B47871C5018C819ACCBD6834
                                                                                                                                                                                                                          SHA1:D37C0B3A1DBD9A4A23F5ABC13D50E2EC5104D7BD
                                                                                                                                                                                                                          SHA-256:0B5C5AF581CBF9A871E59653CF7A2645CE32773237736B034CCE780C0A9647FD
                                                                                                                                                                                                                          SHA-512:49FC94F2ABB0344FE0A2865DA96849EE197B0CD65BDF236D468A4B454BB4AF7A199C3D52C7F853536B9E379E79A8C7E4EF6B3380205010C4E4260DBB9CF59A7E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^.............f......p...............%........................f.................. .........................................Rich............PE..L....W~\...........!.........................................................@............@.........................0.......@........................X..h7......8_...................................................................................text...<........................... ..`.rdata..............................@..@.data............@..................@....rsrc...............................@..@.reloc...}.......~..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360ShellPro.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):426608
                                                                                                                                                                                                                          Entropy (8bit):5.717178230051333
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:rQnyLQCLBvaGjL5QvFY9XExKucH+fOkEXRTrC6kpitmdD019Y5:8CBaGjdQNsucH+fOkEXRTrC6/mdD0o5
                                                                                                                                                                                                                          MD5:94628247EE8A82C02A066402D87FE27E
                                                                                                                                                                                                                          SHA1:1C0951501A9D113D7F5FA5111CF78F43FE7C22C0
                                                                                                                                                                                                                          SHA-256:FFC61CDB73B4540B2E48BEB2F5017A571F797D0CCAC28719862207427D6F07DC
                                                                                                                                                                                                                          SHA-512:E409B2DAED2EAFEEFAA3AEFCA4007E6636F1AB652B6AC944F3601AF595720D1EDCA3FC9CA0F3BF67EFA1D8313FDC4C364C1FC7610FA07D4EC04F7D5F8B463A33
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9..7v...9...A...9...A...9...A...9.......9...9...9...A...9...k...9...A...9..Rich.9..................PE..L....f.U.................n.......................@.......................................@.....................................x.... ..dr...........l..............0...............................p...@............................................text....m.......n.................. ..`.rdata...F.......H...r..............@..@.data...`D..........................@....rsrc...dr... ...t..................@..@.reloc..|........ ...J..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360SkinView.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1049856
                                                                                                                                                                                                                          Entropy (8bit):6.502761341353492
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:UZTETjuQkaRUHEMuDZ+Haby+/RjnbpEw1P4YZgepD/H27+Bl2e5bjYcqn6MgWw6G:vjukpdpEaAYbpD/27Ul2afYc+6Mgyc9V
                                                                                                                                                                                                                          MD5:61D9783B5A1E4B01A737D4A2E4E4C776
                                                                                                                                                                                                                          SHA1:CB63DFA6ABEF40352B6172E410CED514DE648669
                                                                                                                                                                                                                          SHA-256:BC5E9CEB7FD09B6C4B945BC8D4ADA428F2CF5D9311180BFDAC7AFD7AD480E7B4
                                                                                                                                                                                                                          SHA-512:16ED069651197C3523E2C9E1275FAE1473FC9303446C64DFF533AFA5461BDB9DEA09D3CF08B7A5C12F3275DA2A73F414008DF9AF0E7AC8CB0D7880684B58B6F2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p./.4.A.4.A.4.A....5.A.=...+.A.=.....A.*...0.A..K/.5.A.=...k.A..K,.=.A..K:...A.4.@.S.A.=...u.A.*...5.A.=...5.A.Rich4.A.........PE..L.....f`.................~...>...................@..........................P............@.................................T...h.......................hB..........`...................................@...............D............................text....}.......~.................. ..`.rdata..$...........................@..@.data...D.... ...X..................@....rsrc................`..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360TSCommon.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):496096
                                                                                                                                                                                                                          Entropy (8bit):6.489808821775816
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:coK4MftdCfARkv9hqaMk15eeSPYUGEV0rQCaqn6Kd1L0YL+ou:W4Mi/MkClz0rQCa+6KHL+N
                                                                                                                                                                                                                          MD5:E5EA576B85D53437A415BA6F583640B5
                                                                                                                                                                                                                          SHA1:7AF8662445F37459835177248D74F43C944AC4CB
                                                                                                                                                                                                                          SHA-256:90963029EED69B4C47A39973FF1D67DCBC7EA07BA7F3DDDE71A7D83F337EDD77
                                                                                                                                                                                                                          SHA-512:AA976ACE6BE31B6C86FD5479F8269E95CBC0BC27A9374EC9CC70E4A71AFF9737E0B1A38B5269B69459027FFD66FE216B1FD422772B91A189F17144279602DCFF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.W1#.9b#.9b#.9b..b".9b*.b=.9b*.b.9b*.bt.9b=.b$.9b.eTb&.9b.eBb8.9b#.8bu.9b*.b..9b*.b".9b=.b".9b*.b".9bRich#.9b................PE..L.....Yf...........!.....&...<.......`.......@............................................@................................p...x....0...0...........h..H)...p...>..`C...............................4..@............@..d...h...`....................text....$.......&.................. ..`.rdata...f...@...h...*..............@..@.data...dw.......<..................@....rsrc....0...0...2..................@..@.reloc...e...p...f..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360TSCommon64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):639968
                                                                                                                                                                                                                          Entropy (8bit):6.155354507917784
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:iXUoXgTZnWUUtCYw06nkr7o/fo6kMsl7M6ulYhJSYfs9qn6lyQJsoo1:iEoXgTZnWUUtCYw06nk+RkTI6ulYhUDy
                                                                                                                                                                                                                          MD5:001FABB43EB84947FE62B0B35539EF83
                                                                                                                                                                                                                          SHA1:F5F43FAB1A7CE7DB58211E4B76AD5F6355F2B09D
                                                                                                                                                                                                                          SHA-256:E81E33684FDAF8EF7A9A15EE1B217681DA9B1A4FB42D5883BD2489C26A2D39CB
                                                                                                                                                                                                                          SHA-512:51E335D49DB28DEA6B6FAD7655A05368F504AD376611CB637BA836828D4E1294EBE80654259621428A5F86183ADFD52685AB73C542C0158F12A8C5A33432BE52
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... gn. gn. gn..(..!gn.)....gn.>5.$gn.)..gn.)..xgn.....#gn...."gn.....?gn. go.vfn.)...gn.)...!gn.>5..!gn.)...!gn.Rich gn.........PE..d.....Yf.........." .....R...B.......C.......................................0............@.................................................(...........D0...`..8m......H)......P....v...............................................p...............................text....Q.......R.................. ..`.rdata...@...p...B...V..............@..@.data............N..................@....pdata..8m...`...n..................@..@.rsrc...D0.......2...T..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360TsLiveUpd.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1768680
                                                                                                                                                                                                                          Entropy (8bit):6.519662563735593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:bqyoppMC3ezCb30zKiKYl+jX+Bk5N9ndZlW0Uc04KzThfuvG51rI2d3VroatPg3+:jQbkzSYl+aFUUhf3LIE3VEarMly/
                                                                                                                                                                                                                          MD5:F5DF8943BAB4C0CFB57959F0DEDEFB19
                                                                                                                                                                                                                          SHA1:F84C1CB3FCADABED93D8EABAE7A1B333A5E8A5BC
                                                                                                                                                                                                                          SHA-256:7A6DA62266C1DBE2CD0D715FB8B63DB33E2893710A32CD30F9E4C2429D1C7A39
                                                                                                                                                                                                                          SHA-512:0C5934F72989D89BD4912A4948E36143C634F285C0B7CA7BB40D6BC91D0473142FDFF606F43C11759162CE3EA2C1F8B6288CF1B6D8A823E2ECFA946C85551239
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S~..............P]......g^......MO......gB......gH.....0.............0..2....gO.....M_......gZ.....Rich............................PE..L.../.he.................R...x.......|.......p....@..........................`.......G....@.....................................|.......................P,......D....w...............................n..@............p...............................text....P.......R.................. ..`.rdata..N....p.......V..............@..@.data........ ...H..................@....rsrc................H..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Util.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):692192
                                                                                                                                                                                                                          Entropy (8bit):6.565233888192611
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:IpsvoQzr56X7kRUiWs5a1uw1QVyRJB12sq8nqsPgR7A1f0TLgeodDMyL9S:Ipsv/zr56X70dGfnDnqsPOIf0HgZdIME
                                                                                                                                                                                                                          MD5:D9A8493F1CE7B60653F7FB2068514EFF
                                                                                                                                                                                                                          SHA1:C8C0DA14EFEB1A597C77566BEED299146E6C6167
                                                                                                                                                                                                                          SHA-256:77CEE2E41FAD67986C6C6E1426BC6BDAA976B1DCD3B24F381376B201D201581C
                                                                                                                                                                                                                          SHA-512:0B500630E13AEFBA621C0F66AEF5F2528C0FA0C91DEAF19E92999C6377908F53F3A6B23FB90723B890155877AB7B8B40EACD851794B23FF213CC33013734415F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$.......t3..0R..0R..0R.....2R..#..2R..$9..7R..;..2R..#../R..#..4R..9*G.2R..;..1R.....%R..;..:R..q5..3R..q5..:R..;..'R..;..5R..$9..:R..$9..1R..$9../R..0R...S..b:..:R..b:..2R..b:..:R..;..{R..;..1R..;-.1R..0RE.3R..;..1R..Rich0R..........PE..L....5.`...........!.....\...................p.......................................N....@.............................|...,...T.......X............P..H?... .......&..T....................'......8'..@............p...............................text....Z.......\.................. ..`.rdata...0...p...2...`..............@..@.data....W.......,..................@....rsrc...X...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Util64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):862688
                                                                                                                                                                                                                          Entropy (8bit):6.14523322128877
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:pPSAAvHV4fZUvfgmaxpu1FCJ6xMYcMk9u:9SAWHV4fZUvfNazu1Hvc8
                                                                                                                                                                                                                          MD5:8B14A80D926FFDAB593B6BC0B002B9C4
                                                                                                                                                                                                                          SHA1:C84C938543EF6D2C42AD0C61F970E3D1CCB3BE44
                                                                                                                                                                                                                          SHA-256:669A13733CE62EDAC298F91F957EBC7C748918D07C7730E94FD930D6141F8078
                                                                                                                                                                                                                          SHA-512:D049F415DB5DC5C38A968251E72930A8A90E126617F514B0566F203435AB8F1E96371C2C8F0F40CC60DBCD48B284BF46369D377EB4FA61E4FEC6DEF054BBB744
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........,>5.MPf.MPf.MPf.<Qg.MPf..Qg.MPf.%Tg.MPf.%Sg.MPf.&Ug.MPf-$Qg.MPf.<Ug.MPf.<Ug.MPf+.f.MPf/$Tg.MPf.*Ug.MPf.*Tg.MPf/$Ug.MPf.$Ug.MPf.%Ug.MPf.&Tg.MPf.&Vg.MPf.&Qg.MPf.MQfoLPf.$Yg.MPf.$Pg.MPf.$.f.MPf.M.f.MPf.$Rg.MPfRich.MPf................PE..d...:5.`.........." .....J..........`........................................P......I.....`..........................................+......`,..,....0...........d......H?...@..........T.......................(....................`...............................text...(I.......J.................. ..`.rdata.......`.......N..............@..@.data....e...P...0...<..............@....pdata...d.......f...l..............@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360Verify.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):98928
                                                                                                                                                                                                                          Entropy (8bit):6.440776062929005
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:BwfXtca5tCoudlkRLK5wkVTac6S0a5jixLII8:BQRL20dfa5jiVIP
                                                                                                                                                                                                                          MD5:6A805C15A92DC7F7E3EFFE2696F10935
                                                                                                                                                                                                                          SHA1:A3809A2EDDB96A34FBF6D90DE3D4E5EF07A31104
                                                                                                                                                                                                                          SHA-256:B6F7F98264EEB769A89E14EEB4090B056EE62F49F10BD4DF9EBC30BE517BF45D
                                                                                                                                                                                                                          SHA-512:82BB1D6DFD05B92FF2B5EF7B0E6BDE10F68BF85B4EAA61B5F911BA42C40E38AFE24A049FF5BBD3A9AE27769750E7B7342F7EBA0CE08DB7825F1A88CE41B540F5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t..0..0..0..9.H."..9.^.V..9.Y.....a..2...a..?..0..L..9.W.5..9.O.1....I.1..9.L.1..Rich0..........................PE..L...a..T...........!.........p......tZ....................................................@..........................I..Z....@.......................l...............................................3..@............................................text............................... ..`.rdata...:.......<..................@..@.data...86...P.......6..............@....rsrc................H..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360bps.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):852
                                                                                                                                                                                                                          Entropy (8bit):7.396126826941923
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Grly+mAUWRR9ZR1jil1Rpe3+P9/aucZY/19:6lyFAUWRR7R1w6nuDP
                                                                                                                                                                                                                          MD5:B1886FD49B27C856A69C8A628EA0DD69
                                                                                                                                                                                                                          SHA1:BFC43FE076DF9B7BD66EA4860BC96690867D7DA7
                                                                                                                                                                                                                          SHA-256:88034513B12B5483E96FE1B9493659D87E073626D12F60168A7BB8840955DBA8
                                                                                                                                                                                                                          SHA-512:F5EC765A4A07422B104D9EC71517C028489F26E16ED10DFFA5C33FE03A45228AE9F95B79CAA787830C7EC5CE4E7F1EE3994D4EAFD72A061EDAFD37BD494EF3E7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|.................3X....3.6.0.b.p.s...d.a.t.............................................................X...|............a.N.<`....5....K...............\.vo..k...._...\<(h%..w/......k.9j!}....%.=.hl;^@B..y...m7.p.].eq#...R0;..J.M.Q.pc..D.p=L..M..4._9.....:...N....=...f...,...|...f.....].CyRg.gD.E.*..ty.+".l."JH..f..N.B.r.*.B...........a....,.L.E..{..Iq..+...(....NZ.B./Wr.6..c%...'.v.F....?<U..62.?...Upn...A...;w...wi...wy..Z.g.. .......o.r..]_.k..'.wvj.?.d"..=.>1.V.a...b.[.9b......J5...../.p.Z=..Z*.A.$..nE...Mx.V....`k..P?.|%.'._.#...x.L..5`.....iL..T0..L6.u+:..sXD.m....`...ICi..fL.~d.i7.Y.$1g...&..E.0`<..r.r...I.}yF.8.F.u...e.PD..-...bxn...s...,..C...{.O.}...*...R.m'\YA.-=..H......Sm.q..4....>.@. ..6.FG................}w...d.o..S.<M....z..."....d.7d&.r.2.t.s.4......[.X.>...P...t.4.~...c..z...*..;....U...Y.g.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360net.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):491072
                                                                                                                                                                                                                          Entropy (8bit):6.756449375801448
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:ZrnuBRzB5QEfBBPjoPbyf7RCEmK1eSEQA59QTl9h:ZruB5BMPbO0hSPA5aTlj
                                                                                                                                                                                                                          MD5:7D008EE2F8458E25E7934901DF6F3DE9
                                                                                                                                                                                                                          SHA1:E0150F13F5013DF95C17D01834E421FEF4A8713F
                                                                                                                                                                                                                          SHA-256:171DD502AF5BB9057401E35B4F659F12A3EB4DB387DA70EC12E0D05FBD7B1EF6
                                                                                                                                                                                                                          SHA-512:7150AB4100957459F1C76B54143F6A3EE00020A68CB5F12694A98F3A5F85280603C021F001C5C5B2831E7E65965C900930CAB29A825C40799454D666263CFFE7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........r...!...!...!..!...!S..!...!..!...!..!...!..!...!.8.!...!...!...!..!...!..!...!..!...!...!...!..!...!Rich...!................PE..L...=+.[...........!.........n......7J...............................................z....@.........................P................`...............F...7...p...5..@...............................H...@............................................text...l........................... ..`.rdata..............................@..@.data...He..........................@....rsrc........`......................@..@.reloc...E...p...F..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360rcbase.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8956
                                                                                                                                                                                                                          Entropy (8bit):7.916224966080849
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:0rFNoEU2a26IvJb2ZnjVC4Wip6y23tfQcq0dvx0s8lCLJPbMLlNUrYYpGn:0RNBU8TJ6ZnjVC4zp6Nx/4OhbMRqr5I
                                                                                                                                                                                                                          MD5:73DBAC7777B3CE3EC0C499C96F4352E0
                                                                                                                                                                                                                          SHA1:F8F74E5E131BB90A3124537A073CE1D59F44D70B
                                                                                                                                                                                                                          SHA-256:28DE9452C51D2A1AE83BD6A8D90AF4FFE3B8996B3C1C9091E1EE0CEE6D7D02B6
                                                                                                                                                                                                                          SHA-512:F636ECAF38DCCFCE02FA65958C835833DD6E07FEC989DB2842C734528D4DB33531BBD0D831703940A5AD4104522C725EDA2A94555AAE8D71CFDAC3081FF47152
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...0...0...1.0.0.1.............................................R...................................................................3.6.0.r.c.b.a.s.e...s.i.g.n.......................................................................................................K.|>..R..m...4..W...g.G..xmX.I}D.Jx..z.;..R@......F.>x0kS..^....8m..!3.d.*.K...r:H\N.J.G[...iV.n.$,........B....v(l...J..t.........H...........$.J.....H...............b..S.Ru...5....3..3..n.y.j.T.o...r..%kO,..1..w'.0e..FG....G..].Dzj.......^...mN..7.!^.t...#LM:...F.L.k..?E....]r..G...h.>..C.C...G.yx`..D.G...^ ..)..@/MCu.,'.....$.T..8....5...,..-<..N'K/...Dy.I....RC......2.1.......y..._.$....^...t ...bp.....=.h.D..V......y...C.t.x.D..g..H.&0.....F.7..v.L......"& ..i...44f....e..X)%.~.e.K..FXeO(..[.....y...f.....f.v.q..}..6zy....q.|Om.....k.F....G...T.P..B$X.{.l..i.Yv.IGl..a.PmT..+.S.....P.*............J....R..R...).u:...%...+..{...Gi...acX.4cz...1.F...1..U..d....$un...L....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\360ss2map.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1546
                                                                                                                                                                                                                          Entropy (8bit):2.8094599983143556
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:OI4/jlBLSLjbO024Bqj0tzceWDFALzvTZL+F:OIgjLLsj6DgtzcRDFszvTZLo
                                                                                                                                                                                                                          MD5:C919F93E36469E2F8134073FFB9FFA51
                                                                                                                                                                                                                          SHA1:F20E8882B771302573BAABCBC3D95F5085B9E6FB
                                                                                                                                                                                                                          SHA-256:22139B7D1CA93D31150773CA4AE95B3BD5AFB6D8B6006DC316E0EA85CDDCE41F
                                                                                                                                                                                                                          SHA-512:7A2CD9CCDBBA4F4E929E2AAA68891B25D8E6998B95577C4038B8510147F2D264DDC30D80290A8FAAD0821E69C4C39711EF16D7A663835AF8EF4CAE0E455F818C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:......[.s.s.2.t.s.].....1.6.7.5.0.=.7.1.8.1.....1.6.7.5.1.=.6.2.4.5.....1.6.7.5.3.=.6.5.7.8.....5.3.2.4.=.6.2.1.5.....5.3.3.0.=.5.6.3.6.....5.3.3.5.=.5.1.7.4.....5.3.4.3.=.5.5.9.3.....5.3.4.4.=.5.5.9.1.....5.3.5.1.=.5.3.0.2.....5.3.5.6.=.5.5.9.2.....5.3.5.7.=.5.3.8.2.....5.3.6.4.=.5.1.7.2.....5.3.6.5.=.5.6.5.6.....5.3.6.7.=.5.8.5.2.....5.3.9.9.=.5.7.8.1.....5.4.2.5.=.6.7.0.0.....5.4.7.4.=.5.5.9.7.....5.4.8.9.=.5.2.3.0.....5.4.9.5.=.5.3.0.1.....5.4.9.8.=.5.4.0.5.....5.5.1.6.=.5.2.7.9.....5.5.6.4.=.6.6.9.6.....5.5.6.6.=.6.7.4.1.....5.5.7.0.=.5.2.8.8.....5.5.7.5.=.6.6.9.5.....5.5.8.7.=.5.6.6.2.....5.6.0.0.=.5.4.2.6.....5.6.0.8.=.5.3.4.8.....5.6.1.4.=.6.7.0.0.....5.6.1.5.=.1.3.4.....5.6.2.6.=.5.4.4.6.....5.6.4.9.=.5.2.3.9.....5.6.5.0.=.6.0.9.2.....5.6.5.1.=.6.9.4.8.....5.6.5.2.=.6.6.9.6.....5.6.5.3.=.7.1.8.0.....5.6.5.5.=.6.2.4.7.....5.6.7.5.=.6.1.4.7.....5.7.1.1.=.6.8.3.7.....5.7.1.7.=.5.2.5.6.....5.7.4.8.=.5.4.0.4.....5.7.8.3.=.7.2.4.4.....5.7.8.5.=.7.6.5.4.....5.7.8.6.=.9.2.6.9.....5.7.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\3G\3GIdentify.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):215152
                                                                                                                                                                                                                          Entropy (8bit):6.587572924860332
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:2LZ3v5xpPv87C1jgCH+r4NHWhEt0ZlIbHnsGaqNiucydyDm5dua4vv:2VxHEC1T+rGWhdynaqNiucyfF4vv
                                                                                                                                                                                                                          MD5:F2B8F1A361B07AE1D951B43DE861B8D3
                                                                                                                                                                                                                          SHA1:B5518BEC7F2DC411A83D85483B350C1E66CEF89F
                                                                                                                                                                                                                          SHA-256:FF9300FD50350D78C19CF977D7B3EA0AB7E4996C6AE4223FD64FF156E4A1CF27
                                                                                                                                                                                                                          SHA-512:B0A2F5289F583A9B2FEABA3C0AC648E72CE56FE5F35937D80AAA21B3AFD03EC1DE2ECA36A306C651EEA06F8CEBB683C405A3086F752FB2E963CF19AD7383CF2B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X..6..6..6.....6....Y.6.....6..iM..6..7.U.6......6.....6......6.....6.Rich.6.................PE..L...y..T...........!.....x...........R..............................................%%....@.................................|........@...............2.......P..........................................@...............@............................text....w.......x.................. ..`.rdata...f.......h...|..............@..@.data....;..........................@....rsrc........@......................@..@.reloc..R(...P...*..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\3G\LibOui.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):365926
                                                                                                                                                                                                                          Entropy (8bit):7.992308703839501
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:6144:XUOfHjsIeShjgQHw4Qmm3/LFKo+HsGIuccOaAdd2FfHYtdfmiF9fgxC/fQ4w:ZfHQITjgQ9Rm3jFKMGIpdo5Edfmizgxf
                                                                                                                                                                                                                          MD5:BD53083AE48BA64C983876CE726A09B0
                                                                                                                                                                                                                          SHA1:0B7F2CA4CB6E2D8871D29F258AA99407D94E8158
                                                                                                                                                                                                                          SHA-256:C751C7B02C2C5E815ABD46167DA7225B8BCAAFF9284C6881F72C337621F0B3C6
                                                                                                                                                                                                                          SHA-512:EB37CABB9ED03C7BB021E647E9FAB0E51770C2B50A95869CB004824E73911F55E15D5A9F1C51EF31DC699EA3DC1C98E387A0B0E55C666E62E2AB16096F07F9FB
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............*............`|..........................bR..b....1..w...L.!...=2.M.51.).Mdso..H.k......H..o.w.lj.+..@1.`.`..C.)../.1.b. .'a..u...8.-.a....r...eK...:..@]..?A.......7.1.h8..Q.wP#v..S.........|!>..T~...*+..................>.T~.;u....z....t^>.T)..v..%w........~W.x.......|v9A...0l.k........~.#E8..!|.jF...=!.....:!c....\:..F.R.e?P.......o!...~.Qy..O...x..(.f}XM_....D.u9..;c].F."'/....K...w.....R.;..q=....Y..x'..1:......w...>.....\.c.....v..x..O...!.nOA..*...........V...H._....P!.i8......o..dag.n.Z..oq.LFj....hX...w..W.F.. ...Mz.N.h1...].....]~..WZ6y.:.,.AF....or.M....<...^..nJt.S.7..g...Y7..M.nt....a....:.p8..;...#..^..[k..|.....9.s*....\.3.....3.Z&>....K7.Y.....e..h...d...d.I.z..vnz.j.6.|n..i;t:#...=...e..v.........8L.@.3.JF...;.Z1K.......t.A..8...8A%..a.V..e....x}6..t....H.R}.#.^...q....5!.w....%...l&e.....'.C.i..e.W.. ./..~.B|...=..].....&H.~......s.t.*...U...8.Z..~..@7.........K.%....P.|...f.,...2|P.H=......=.....`.).M.&m.9A.(

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\AntiAdwa.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2565888
                                                                                                                                                                                                                          Entropy (8bit):6.463453309269488
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:SGaGIFzKwpaUcqVCFWwn+MJT35EkdhHnUBfSe/I3QsPI8mlX1:vIFzeyCWwnZJT35EkLUBfvWQsPIR
                                                                                                                                                                                                                          MD5:E8E931C6CB67081BF61678ECD8F02E88
                                                                                                                                                                                                                          SHA1:4A73A3A5498911A618E00FB4B108E21B6C55509F
                                                                                                                                                                                                                          SHA-256:B6057C0F78439EB23A402FB53430E07E00BAD0C7E460C2A1CEA80B51F912E35B
                                                                                                                                                                                                                          SHA-512:B28046407D481A4776120591B6847637685E0D7E6839A19782167F7D4F16E1AEDD8F79F38295B55B50C71F274B26A82B612B3F8282E63DC8563B1393E06C2754
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$........7](.V3{.V3{.V3{8'2z.V3{.>0z.V3{.>7z.V3{.=6z.V3{.?2z.V3{8'6z.V3{9'6z.V3{...{.V3{...{.V3{.?7z.V3{.?7z.V3{.?6z.V3{.?6z.V3{.>6z.V3{.=7z.V3{.=5z.V3{.=2z.V3{.V2{.T3{+?7z.V3{+?6z.V3{+?3z.V3{+?.{.V3{.V.{.V3{+?1z.V3{Rich.V3{........................PE..L... ..`...........!...... ..0............... ..............................p+.....'1'...@..........................#.......#.|.....).Pf............&.hB...@*..*..@.".T...................8.".......".@............ ..............................text..... ....... ................. ..`.rdata...... ....... .............@..@.data.........#.......#.............@....rsrc...Pf....)..h...N%.............@..@.reloc...*...@*..,....%.............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\AntiCe.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):238080
                                                                                                                                                                                                                          Entropy (8bit):6.605673456461499
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:FBrwvNZUMVE6RcxN8guMiQWXkgEzsyRpKhIJmL+gQ4FcS65qkooooyx8hAJFu:FBwvDRSNOHkgSsyRwOJG9Fcyq
                                                                                                                                                                                                                          MD5:9D328D343A99DE9DF44D6A5541785E55
                                                                                                                                                                                                                          SHA1:DE3F44BEF3832A4489E5DC97E1A592F127306890
                                                                                                                                                                                                                          SHA-256:C290B029CB8E53C970FB7AB36FA70109E362793FDE1A6EBD3E2F61583EC628B2
                                                                                                                                                                                                                          SHA-512:BB7E95B9E5D539D4B0289A2407A78A93AACAF287C9F6476EF8334CA46BF7368515994CD9BABBC9485BC27AECC91BC8738F372681518543846E764693B1E04722
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V...8...8...8.....8....8.....8..+U...8..+C...8...9.p.8.....8.....8.......8.....8.Rich..8.........................PE..L...l.e\...........!................................................................6.....@..........................)..L...$........p.. ............j..h7..............................................@............... ............................text............................... ..`.rdata..,j.......l..................@..@.data...@6...0......................@....rsrc... ....p.......2..............@..@.reloc...,...........:..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\BrowseringProtection.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1316864
                                                                                                                                                                                                                          Entropy (8bit):6.433151964086922
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:CbFZjXfcm0ljOguShwQ6n5P5YkRdLv+RgSqDPaOx+VE:CbFW2g56n4kj+RVVOUVE
                                                                                                                                                                                                                          MD5:0E19576ED0876D7C2C4D4EB941B0BE43
                                                                                                                                                                                                                          SHA1:AE280A04A0C2640F9AAB454C92C3C68F07DCA27E
                                                                                                                                                                                                                          SHA-256:AD8D79FA85B270557B486EB7CBC6CFC84498AE4D8573B2B19ABDB0956C231A9C
                                                                                                                                                                                                                          SHA-512:90790F247E40C6E31DE739699F7963E2782E85925C3C3CB90AD08A5532097D538E5F7E9E5E9CF112CEBA0941FB3AEC132C4639B55B3452F87BB77AA3A9C4C702
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..m...>...>...>..i>...>..j>...>..l>...>..|>...>=..>...>..{>...>=..>...>...>...>=..>;..>..u>R..>..{>...>..k>...>..n>...>Rich...>................PE..L.....|\.................8...........O.......P....@..........................p......}a....@.................................t-..h.......|...............h7.......z...W...............................j..@............P..,....#..@....................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data...|....P...D...<..............@....rsrc...|...........................@..@.reloc..j............6..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\CombineExt.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):150344
                                                                                                                                                                                                                          Entropy (8bit):6.598171809193164
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:R5VF7tVwj+U1KBQ7AxSnZvilziCkEjNlApXGLZiK1xAaAt45i9lIL:9aSenAxcvilOGlA8ViK1ihg
                                                                                                                                                                                                                          MD5:80E2F9967F757A6A7C5E0CB2D0196160
                                                                                                                                                                                                                          SHA1:33BE217E5904DC3EC0E8FA9AC7CF56A0657BF8FC
                                                                                                                                                                                                                          SHA-256:C4D3C39083FBFB6CEF2FAC14A17BB2FE1BDA4464D693C1C63094C596D0A59132
                                                                                                                                                                                                                          SHA-512:44335C1D9B400F03EF8F4A2BD19A828E6EA67A0B558046914DE626D3FA57C3DA703F8DDD091DAFA5075D234A2F27036446FC57C83B0F45435597004CD4C53EDA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........|../../../.?/../.)/../../../.!./../../../. /../.8/../.>/../..=/../.;/../Rich../........PE..L...x..S...........!................B........................................p............@............................._.......P....@..P............0.......P..................................... ...@............................................text............................... ..`.rdata...N.......P..................@..@.data... 3..........................@....rsrc...P....@......................@..@.reloc.......P... ..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\CrashReport.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175072
                                                                                                                                                                                                                          Entropy (8bit):6.569280122977913
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:qUWvM9A5UEPeA9ggz/3ezHkta1D+ThXn/n9SGeM7:2Urcz/wEtZlf9b
                                                                                                                                                                                                                          MD5:94A08D898C2029877E752203A477D22F
                                                                                                                                                                                                                          SHA1:D8A4C261B94319B4707EE201878658424E554F36
                                                                                                                                                                                                                          SHA-256:07ED1D3443E7F9B2531AAA0B957A298EA6C5C81BCD321E7FAF25A17A85063169
                                                                                                                                                                                                                          SHA-512:79A2E121665E403767E5278BDBAC6C52F6CE048D0C3968A2FB5053229C5D98E9275ACBC48806C45B8BC2E807F6E52EE4DAD54924B758DB8328FB262C6FD176B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c................................................................>...................................Rich............................PE..L..../.`...........!................................................................?.....@.................................$...x....`.../...........l..H?..........P...............................8...@............................................text...x........................... ..`.rdata..AH.......J..................@..@.data...4G..........................@....rsrc..../...`...0..................@..@.reloc..X ......."...H..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\CrashReport64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):204768
                                                                                                                                                                                                                          Entropy (8bit):6.22830582108309
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:vdgwkyK6saI/qiU8zpBoE0wIdFlPwhJHocy0jgD8dXPNwpaojmF55S9heMA:vdgLyK6vilMbdFlPwhJIA8YF1Am09s
                                                                                                                                                                                                                          MD5:F0EC259BC74B69CAC5789922187418B5
                                                                                                                                                                                                                          SHA1:99E738A12DB4A60EE76316AD0A56604A5F426221
                                                                                                                                                                                                                          SHA-256:09EAFEDA04F79FD1FAF273EFE104E877B719FB31689838AA12A3E6D3384A3DA4
                                                                                                                                                                                                                          SHA-512:630CF0A30961AF6D41D24F2D2FC81E0C10C99E19241AFF7E14AA38317EEBBE01E5D85C1CB5848ECFD7B75E2FE762CF4A07FEE781D052B48F0A3C15A37505DAC4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U.u.U.u.U.u....T.u.\... .u.\..._.u.K...Q.u.\...`.u.\...D.u.U.t...u.\...D.u.\...T.u.K...T.u.\...T.u.RichU.u.........PE..d..../.`.........." ......................................................... ......|.....@..........................................[.......O..P......../......h.......H?..........`................................................................................text............................... ..`.rdata...l.......n..................@..@.data....^...`...<...R..............@....pdata..h...........................@..@.rsrc..../.......0..................@..@.reloc..l...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\DailyNews.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1109472
                                                                                                                                                                                                                          Entropy (8bit):6.394406166279379
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:uXXfApLVA9+k5w2aq5NJKNrPf+6LImqBc6:SAQ9+k5w2FPJKNbWsIfBc6
                                                                                                                                                                                                                          MD5:6C214BE1D64DB1C24F926203F6FDDAE6
                                                                                                                                                                                                                          SHA1:DFE630BB99DF44F4EC31B1161ABE7E663EEBAE2E
                                                                                                                                                                                                                          SHA-256:468C661EA0A7F31D9B26940CDCDC562370459D6E5F48A211BEC8EDFD17376959
                                                                                                                                                                                                                          SHA-512:A92CAE728BB90CCCBCC5B01C11DCF41388594FD107E876496F0D1242F565A93B49710084BA39099464D3BBE9D81E305D3D3B1BA22BA745A220A5B447274AD6A7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..9..9..9.~....9.....9.....9.....9..tW..9......9..tT..9..tB..9..8.9....a.9.....9.....9.Rich.9.........PE..L.....Bf.............................`............@..........................P.......z....@..................................G..T....P...w..............H)......<............................/......H/..@...............X............................text............................... ..`.rdata..z...........................@..@.data...$........n...b..............@....tls.........@......................@....rsrc....w...P...x..................@..@.reloc...w.......x...J..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\DumpUper.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):255
                                                                                                                                                                                                                          Entropy (8bit):4.848437979222634
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:+FIx9o4hXAUqGXiKeln6HJqmjCCLDOCI4UKxLyKxOXKxV:+mBQln6VjnOCIjMeMIMV
                                                                                                                                                                                                                          MD5:2668CE9C7E8941EA875256EDF1A8AB80
                                                                                                                                                                                                                          SHA1:5633587D5840FB2D4CAAA583BBB3068BAFBEB904
                                                                                                                                                                                                                          SHA-256:4E3CF28EF3CE5B806C632F99482560A5246DE9F86AAFB7A47CDC78E5B4B019A5
                                                                                                                                                                                                                          SHA-512:B92440A8B3DFC54C577A45CD132F07C525300DE90297F89ACE88B7395432CCDC08B3CC9CDA4C523CF82B46D371EB4869A8ED8B3D0720977AFD983634037C61B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:[NCS]..id=16..domainName=http://crash.pcsafe.360safe.com..crashInfoSite=interface/crashinfo..homeSite=pcsafe.safe.com..dumpInfoSite=interface/dumpinfo..productName=pcsafe....[PromoUtil.exe]..showdlg=0....[DsMain.exe]..showdlg=0....[cefutil.exe]..showdlg=0

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Dumpuper.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1467456
                                                                                                                                                                                                                          Entropy (8bit):6.696483543500351
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:VfaQrkd3qdmrbcO7FGIJoZv3p7lRr8osPESs47X4und5GUEv5+6FxTPWtwFjI3XE:ZaAkd3caFGIJoZx7lRgosPEHcX4und54
                                                                                                                                                                                                                          MD5:BF7D946721599D16E0FA7EF49A4E0EE4
                                                                                                                                                                                                                          SHA1:74C6404D63AB52AAD2E549B8D9061EE2C350AC5A
                                                                                                                                                                                                                          SHA-256:5F21575642ECF7D38BE30AEF50BE623F74DC3644603E0CB48D1B297AE2066614
                                                                                                                                                                                                                          SHA-512:DD8B5E8233033A3DDB30278B2B82C60925BBCA63EDB68AA1E23C0A6A8F0DD8DA21F60846C747FEA83BE7ED1E99ED86379FFFF7B6AEFDE5FFBB85E3F98732725F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$..........`..u3..u3..u3..t2..u3..t2..u3.v2..u3.q2..u3..p2..u3$.t2..u3..p2..u3..p2..u3...3..u3..r2..u3"Z.3..u3..p2..u3..q2..u3...3..u3&.q2..u3..q2..u3&.p2..u3..p2..u3.p2..u3..q2..u3..s2..u3..t2..u3..t3..u3..p2..u3...3..u3..w2..u3Rich..u3................PE..L......_.............................z............@.................................Qu....@..................................P......................,...7..............T...............................@...............l............................text............................... ..`.rdata..............................@..@.data....d.......2..................@....rsrc..............................@..@.reloc...............^..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\EfiMon.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44032
                                                                                                                                                                                                                          Entropy (8bit):7.286674066533635
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:wMB5jsAl3eP2S9qg89Kyh1MVfzbO7e6wA3pSVUValkjD8:xAm3eP24q79gVf3W/3oqsQ8
                                                                                                                                                                                                                          MD5:9FA405B04082D6C73C826750B0ECFFCF
                                                                                                                                                                                                                          SHA1:A7CB48833F5554C8098FC3DA27573A8749F9B79D
                                                                                                                                                                                                                          SHA-256:296F97A993BC5BA8C011F915592F8B53942D303D5A48D48EF778743AD8237977
                                                                                                                                                                                                                          SHA-512:240FCB637C7E8186DD7848A52669FD0FB9DACE76D43378074BA79E4EAA9ABB293AF6BAF1F770FE904B23E3058DC4D0C06207F32EED3029E2B48E39DFD8447AF0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$...........q.#.V..7..."P......}.X-d...F....w<...`..-..P..E..k.Q.A..../.5...:....4...%6.6b4.U..r..q....e...b.]....\..}CI.+.......6.....z.`RR......................................................................................................................................................................................................................................................S.z.................1...N.........K.......K.......J.......N.....Rich............................PE..L....z.`.................+...........0.......+...............................:...............................................0..(....4...............<..ho...8.. ... ,...............................................+...............................text....&.......'.................. ..h.rdata.......+.......+..............@..H.data......../......./..............@...INIT.........0.......0..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\EfiProc.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):110664
                                                                                                                                                                                                                          Entropy (8bit):6.837744559416694
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:xIIjgqtcdyItrRtLds5Fai/ABI2r/lg8JiChOXZsknkxsoTpxiJENn4LoCVv:XFCI8lt5oAPJiNmfxsoTpxiJE54UCVv
                                                                                                                                                                                                                          MD5:32C4FF5DE2F326D8644C7A7D328D29AB
                                                                                                                                                                                                                          SHA1:8809A073470BA2CB1CC50A20D2681E284D7DABB3
                                                                                                                                                                                                                          SHA-256:FA0765961D53045360152FC8E9FD9A922C93C04D055400B5469C2E7961547E5B
                                                                                                                                                                                                                          SHA-512:EC93EEE647FE1B1568BDCB53450F98DB3525AA2107EB4F06FF999C5693CE5FE0FC8F81751F44E9B98387139E0ACA3D531EC0F9C2B97518BC3C30815BF9F27D04
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q...5..Q5..Q5..Q...Q4..Q<..Q)..Q<..Q%..Q<..Q}..Q<..Q<..Q5..QY..Q<..Q7..Q<..Q4..Q+..Q4..Q<..Q4..QRich5..Q........PE..L....g.[...........!.........T......7$.......0......................................bd....@..........................^..f....T..d....................x...7...........1...............................O..@............0...............................text............................... ..`.rdata..6/...0...0..."..............@..@.data........`.......R..............@....rsrc................`..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\FastAnimation.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):591592
                                                                                                                                                                                                                          Entropy (8bit):6.689693646016897
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:rqHCKBmyl9FF2w9Tb+n6P6JAl4sPlcvTX5kS88:rwFjTbuJg4sPlcvur8
                                                                                                                                                                                                                          MD5:E12C9319237EAFB34F2BECEF00273561
                                                                                                                                                                                                                          SHA1:20689C2DCC3AFADFB13FF763C74398EB6F416212
                                                                                                                                                                                                                          SHA-256:BB7623D080B900C816F23A19C7B09082708151E3719AA69B7C34BF556C997B78
                                                                                                                                                                                                                          SHA-512:C89D5685117BCD735256CFDFF70A43C02DBD59D5FE41C469D03D15040BFEEB7A2579C2C645B751006F00FDAF545D5B84EE98CD915B11E0840D0DD3BA927DF0B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$........G.|.&q/.&q/.&q/.Ht..&q/,xp..&q/;Wp..&q/.Nr..&q/.Nu..&q/9../.&q/9../.&q/.Op..&q/;Wt..&q/:Wt..&q/.^./.&q/.../.&q/.Ou..&q/.Ot..&q/-Ou..&q/-Ot..&q/.Nt..&q/.^./.&q/.^./.&q/.&p/.'q/.Tt..&q/%Ox..&q/%Oq..&q/%O./.&q/.&./.&q/%Os..&q/Rich.&q/................PE..L.....d...........!.....B..........`........`......................................d.....@..........................n..x...ho..........................P,......(J......p................... ...........@............`...............................text...7A.......B.................. ..`.rdata.......`... ...F..............@..@.data....+....... ...f..............@....rsrc...............................@..@.reloc..(J.......L..................@..B................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\FeedBack.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1805704
                                                                                                                                                                                                                          Entropy (8bit):6.444319203471152
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:sjbSSaacSl8Gb4CieDSmzDQfCHNU/bgHCpnfATKbt8:sjWSaacSl8Gb4CieDNDQfCmzgHCpG
                                                                                                                                                                                                                          MD5:8E11B5C3C4E619ED4AEE8FF75FCBB9D8
                                                                                                                                                                                                                          SHA1:A0A431EC273AD5839C30E08888EBC0674F6CC8E7
                                                                                                                                                                                                                          SHA-256:A299B6A3F64891A287530EF70FFB2D7E5C7CDB69FC2055FD60A6D2234661217C
                                                                                                                                                                                                                          SHA-512:0D0ACB86EC6E9E28BA951782308C59C515D17BC5B06D2CBA3D33744527FCD9DC66C4C4B47980C394701425C1B6467010E92A9414231DA0E346B702562F958614
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r;.D.UVD.UVD.UV.0FVF.UV.\.VF.UVMk.Vj.UVMk.Vs.UVc.;VE.UVZA.VA.UVc.8VC.UVc..Vc.UVD.TV".UVMk.V..UVMk.V..UVZA.VE.UVMk.VE.UVRichD.UV................PE..L....i.^.................X...................p....@.................................$.....@.................................\...|....................V...6..........@z...............................N..@............p...............................text....W.......X.................. ..`.rdata..R....p.......\..............@..@.data........0...n..................@....rsrc...............................@..@.reloc..(............:..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\FeedBack.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):658
                                                                                                                                                                                                                          Entropy (8bit):3.6898064550277323
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Q+7EZSgNl3CytZCaRio02kFfm6k1lxaiO6k1TYaiI6k1lxa6:Q+hg3ydIiL2kFtk1bjk1TYVk1bP
                                                                                                                                                                                                                          MD5:E4FB34AE85260230B8D44F2F7CE87F55
                                                                                                                                                                                                                          SHA1:50BCAFF149CD9F9369555622DE61A99D605E8E5D
                                                                                                                                                                                                                          SHA-256:25371E45F9DD4F28EC11E7E6E06442E3C7F1BF5199E2C7B7E4FCB494E2021961
                                                                                                                                                                                                                          SHA-512:2C037009E084FB9D32A833D1E174A88EBA59F8D021F03A87620C0AD1EBE876CAF3D4BEEB2730E230EF3B80A268B23E4FADA8DCA8C63F28417F5220E39B886A85
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.d.e.f.a.u.l.t.].....a.p.p.n.a.m.e.=.e.n.....l.a.n.g.u.a.g.e.s.=.z.h.-.C.N.;.z.h.-.T.W.;.e.n.........[.u.p.l.o.a.d.].....U.R.L.=.f.e.e.d.b.a.c.k...3.6.0.t.o.t.a.l.s.e.c.u.r.i.t.y...c.o.m./.3.6.0.t.s.....S.i.t.e.=.....F.r.o.m.=.3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y.............[.f.e.e.d.b.a.c.k.].....C.o.n.t.a.c.t.T.o.o.l.s.=.I.D.S._.C.O.N.T.A.C.T.T.O.O.L.................[.e.n.].....I.D.S._.C.O.N.T.A.C.T.T.O.O.L.=.E.-.m.a.i.l.;.S.k.y.p.e.;.W.h.a.t.s.A.p.p.;.........[.z.h.-.C.N.].....I.D.S._.C.O.N.T.A.C.T.T.O.O.L.=....{;.S.k.y.p.e.;.W.h.a.t.s.A.p.p.;.........[.z.h.-.T.W.].....I.D.S._.C.O.N.T.A.C.T.T.O.O.L.=.E.-.m.a.i.l.;.S.k.y.p.e.;.W.h.a.t.s.A.p.p.;.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\HomeRouterMgr.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1834592
                                                                                                                                                                                                                          Entropy (8bit):6.4676605755563745
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:yL3450FtfMqXPGezr5n0cnrYKMHnM+s/qzUBUO2FdAEY7VN+:CZtUqfHB0cn8hBsuUBdUAC
                                                                                                                                                                                                                          MD5:F791B56733B56B97132351F7DEDA4297
                                                                                                                                                                                                                          SHA1:5528A47C2214A827E0F68EE564B789759EBA81A1
                                                                                                                                                                                                                          SHA-256:1DADE02F4D36D483A918A455FAD19DCF2F6BA993AD33BF8CAC75184D5713CEDA
                                                                                                                                                                                                                          SHA-512:FFFC7B5CFB863C425403F8D2711BC27F4FCE31D274837464B9B7A3047DF25E2DAAF453359B6EFD118614FAA926FDDDD4800D5C932FF61D7C443F3CA4A5119CC8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S..............0_.......'.......$.1.....2......5.......;.!...0_......0_..>.............5......%....... .....Rich....................PE..L.....CY.............................~....... ....@..........................@......).....@.............................................,................5......\....)..................................@............ ...............................text............................... ..`.rdata....... ......................@..@.data....... ...^..................@....rsrc...,............b..............@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\I18N.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):97352
                                                                                                                                                                                                                          Entropy (8bit):6.562409614977568
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:3iG78XouqRzgm2cGpEBP4O86uWkOz2FJt685pjEOBMlo:3iGgNWFGGBUNFD685pjBYo
                                                                                                                                                                                                                          MD5:7E181B91215AE31B6717926501093BC4
                                                                                                                                                                                                                          SHA1:8FCF05C9AC64C46C87ACC1EC67631E7B66363D9E
                                                                                                                                                                                                                          SHA-256:239824A487AE786DAADC9E556C185561378F47EC7BA6B216C17242AEA3A78FF9
                                                                                                                                                                                                                          SHA-512:0DF684BDD9C0A5CCE81DB692E336DCF3E8C8AEC80D5D6FB8620227E2F31D5BFD1D63F9CB7F808CB9511FE483E7798FA6D5A51C0BB1EC3C3C86400767A17A155F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`s..$..$..$..-ja.5..-jw.M..-jp.......!..$...M..-j~. ..-jf.%..:@`.%..-je.%..Rich$..................PE..L....z.[...........!.........f......@9...............................................i....@.......................... ..\...L...<....`...............D...7...p......................................h...@...............P............................text............................... ..`.rdata..<1.......2..................@..@.data...\-...0......................@....rsrc........`....... ..............@..@.reloc.......p.......(..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\I18N64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):114760
                                                                                                                                                                                                                          Entropy (8bit):6.344321468208673
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:eZoB5Miv5jB4IUGcMRzZu9zbXJOkpQ0wU5biMIUIy:/B1v5F6MVizbbQ01ig
                                                                                                                                                                                                                          MD5:A9B8DB4ABBD6BE9687306EFDC7D09E5D
                                                                                                                                                                                                                          SHA1:50DB31C79C881981EAE4C2ECB25915C84B8F36E7
                                                                                                                                                                                                                          SHA-256:31B2596DA4C6A4111A5FF177392C07E377EF0F5666C65F58880CC06B4CE6EF67
                                                                                                                                                                                                                          SHA-512:4637153524FA315A9D9B6BB24490C6DE413ED85831CBB50E6D637FE11AD4F8DDA9300BF21561021E74B78B108617132DAE0F214951B3B38A430F11B135F32D48
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`D=.$%S.$%S.$%S.-]..A%S.-]...%S.-]...%S...(.!%S.$%R.H%S.-].. %S.-]..%%S.:w..%%S.-]..%%S.Rich$%S.........PE..d....z.[.........." .................K....................................................@..........................................g..\....]..<........................7......\...@#............................................... ...............................text...f........................... ..`.rdata..lG... ...H..................@..@.data....8...p.......N..............@....pdata...............f..............@..@.rsrc................x..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LargeFileFinder.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1718504
                                                                                                                                                                                                                          Entropy (8bit):6.412509312451218
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:Im4KOSvZkFZSpBm0UDfEq25OfsFQPlV6eojqKVZCwPacmEc:FvgSps0OfzTfsFEV6eojXVZF3mEc
                                                                                                                                                                                                                          MD5:2D5302155B58CFA9CD5DD0DF2AE69A7F
                                                                                                                                                                                                                          SHA1:B08F33A28845BBCD4437CCBE324320F1EA8422C1
                                                                                                                                                                                                                          SHA-256:5D30AF8A6A594541C532476A03B5320E25CBE06414F284B3F3D4C862C32712F3
                                                                                                                                                                                                                          SHA-512:7DDE142B446AD0C2DF3D8B78EA7D15A98C4B8EA2B53DFBDDADCC6EC1F8681CFC141A9BC8DF47F23EEF75E2C9BBF3D0BAC81DAD296118F1D0056ABA00C740F598
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............r.......q.......`...............g.k.....`...............................n.......p.......u.....Rich............PE..L....`.d.................P...................`....@.......................................@..................................-..@.......,...............P,..........pj..............................p ..@............`...............................text....N.......P.................. ..`.rdata..|....`.......T..............@..@.data...$....`...L...N..............@....rsrc...,...........................@..@.reloc...............4..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LeakFixHelper.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):356928
                                                                                                                                                                                                                          Entropy (8bit):4.739658192843982
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:/jzlAJLUi3q4P9B3vEesq686cQOQMOLBUExK/kFiUQmp3KgYdD:/jRAJLh64P9BMeBAOQbFLBYB
                                                                                                                                                                                                                          MD5:BB58DA308657FCA30466ABFF846A5F11
                                                                                                                                                                                                                          SHA1:9A0210FE0E5D67D5A34DCCD658098F6C7D65128D
                                                                                                                                                                                                                          SHA-256:BBD4CFBE482FD7E5551DA78040666004CF233FD9C8BAF514FD5F822EB2C9791D
                                                                                                                                                                                                                          SHA-512:9974B49C79799DA681D9183A08F1E199DE65FEB43B2F558ADDBBFCDA3F862ECC6BAC3A1BAD05316F59436E34402A80EEAA6DFE313FC718AACF3D78EF2E0370B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S..S..S....6.Y....4./....5.K.....A.....B....(.X..S.......v..5..X..5..R..5.8.R..S.P.R..5..R..RichS..........PE..L...-.v[...........!.........,...............0...............................p......JE....@.............................L.......<....@..X............:...7...P.........p...........................`...@............0...............................text............................... ..`.rdata..p....0....... ..............@..@.data...Dc.......P..................@....rsrc...X....@......................@..@.reloc.......P... ..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LeakFixHelper64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):395840
                                                                                                                                                                                                                          Entropy (8bit):4.438655161766283
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:ivYk5XyZGTAIFsttSaNQtbtZwClxUZlCKgmYPwOXGShnmgDbmDhG:ivYUyZGTFF0tSIybtZr7Qpgbkkx6k
                                                                                                                                                                                                                          MD5:2E54BD84069DC13B75779303C24E6FD6
                                                                                                                                                                                                                          SHA1:DC2D908C094CFE413C0E7F94FEAD2C9E5AC1D2EC
                                                                                                                                                                                                                          SHA-256:6FA6E7D13B2447F33F3939594D6B280E091C3F67AB407F5DB1B860954ABE9644
                                                                                                                                                                                                                          SHA-512:3B59A39C5608B4D2D0064CBCD2AC684C5F9B74E9258F5044D93813C76A1E67242E2C9761D989DBF265745F11A3ED01C34105BE709962119B37D6A54F6FB12EDB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.............6.I.....6.K.....6.J......F.......F......6.W..............F.......F.......F.......FG......./......F......Rich............PE..d...Q.v[.........." ................t........................................ ......r.....`.........................................0...P.......<.......X................7..............p...........................p................0...............................text...\........................... ..`.rdata.......0......."..............@..@.data...............................@....pdata..............................@..@.rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LeakFixHelper64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):187456
                                                                                                                                                                                                                          Entropy (8bit):6.070926115311623
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:4AvpDVQsl6ZWQTAy6OAoHtrqLbML6/N+RK7A5Yht13:4oZQslfYn9LNe664t5Ynt
                                                                                                                                                                                                                          MD5:F7C391E766CD84B7ECF80F687B68AD10
                                                                                                                                                                                                                          SHA1:9FECA041A9300A138BD8AAB6C4439FBD9970AD72
                                                                                                                                                                                                                          SHA-256:531709F0A00F7CC4F7E3014AF47EB88CB7A210494792564A07DA2B3E60832A96
                                                                                                                                                                                                                          SHA-512:23D1538BD5FB8A3B69E664310A809337C01BB32E6576F8FA82C6E67EC52FD907A79640A02A511AB83F1615591EFD618D5B6FF268D32926B6328F40826BCB6766
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..2...a...a...a.gua...a.gwa...a.gva...a.[Ca...a...`...a...`...a.gka...a...a...a...`9..a ..`...a .{a...a...a...a ..`...aRich...a........PE..d...).v[.........."......@...r.......9.........@..........................................`.....................................................P....p..Hd...P..D........7..........`...p.......................(....................P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data....8.......&..................@....pdata..D....P....... ..............@..@.rsrc...Hd...p...f...4..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LiveUpd360.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):427400
                                                                                                                                                                                                                          Entropy (8bit):6.536531068387346
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:2DDWGX8/v1s0g3B47bC9DsfTNtyaf96Sy4Nbb9T:0UjL/CihQafwtabb9T
                                                                                                                                                                                                                          MD5:3F53F8F6F8AE27CD0B2C191130B22BC6
                                                                                                                                                                                                                          SHA1:D8F2439B39A953B73180E73EF3A647C91823C2D1
                                                                                                                                                                                                                          SHA-256:E9FFA1A0215C124A9437FC013AD7E560452E0AD98D77A7A8D281860BF0A4F6F1
                                                                                                                                                                                                                          SHA-512:90B6392F8941ECE6F92D31E913DC10797429E4E65120177E24A8E17432BCC43638ADE9DFB50FEC17C9B0461E182DCC4005DBD2A2C4FD888E2EC939AAB0EB393B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\...............?8.......,......./.......9.......3.....?8................>.x.....(...............-.......+.....Rich....................PE..L...S..^...........!.........V.......k..............................................V,....@............................................. ............N...6.......3.....................................@............................................text...,........................... ..`.rdata..V...........................@..@.data...........0..................@....rsrc... ...........................@..@.reloc...E.......F..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\LiveUpdate360.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):832512
                                                                                                                                                                                                                          Entropy (8bit):6.563307926714665
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:s/PvxjEFCrQRvakoEhXzT+PVvaAdG3n6x4vkwaA49k971N3qkyilwXEAo1EQADV5:svtQvakoEhOPhaAdq9xNAil8EViDSd8
                                                                                                                                                                                                                          MD5:F5058E30E379AF4437E5F8EAB34BA005
                                                                                                                                                                                                                          SHA1:469EBA65C1CEFABDB57EC62E5A10CF9EF67F8B0D
                                                                                                                                                                                                                          SHA-256:F2009682AB5F90120505E4DFBEB0AAC7E16457A6D97EC3F6BBF3C79E34F789F2
                                                                                                                                                                                                                          SHA-512:360D97F069FDACF26F78377D7B54E8E22A3A6704243B7E461F7A904F006DA3800C41C4450F9D0CE7ABCC4012DFE46D5EC728B8D08DB88C96DBCAC8551B87166F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........nLy.=Ly.=Ly.=.6j=Ny.=E.i=Qy.=E.o=Ny.=R+x=Hy.=k..=My.=E.x=.y.=E..=.y.=k..=Jy.=k..=gy.=Ly.=.{.=E.v=.y.=R+h=My.=E.m=My.=RichLy.=........PE..L...k.|\.................H..........b_.......`....@.................................^.....@..........................................................|..h7...P...p...i..................................@............`..(............................text...`F.......H.................. ..`.rdata......`.......L..............@..@.data...<........B..................@....rsrc................(..............@..@.reloc..X....P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\MedalWall.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1426528
                                                                                                                                                                                                                          Entropy (8bit):6.483405626999331
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:AUubv9vW7slUMcjdtsnFVZ+Ghc0zTxm+6S6+tIJT:AUuwGXOqFVZfhc0zM+6Sty5
                                                                                                                                                                                                                          MD5:6E10B7D97CE3A8DA723C80B5C187077B
                                                                                                                                                                                                                          SHA1:C8850D59F850E8AF756EF7923F786F825BCE2D31
                                                                                                                                                                                                                          SHA-256:C7EF88C39B752E1113A3011D9AD58648ADD4801313B5A1F49FE0D4DCCDAA0FAE
                                                                                                                                                                                                                          SHA-512:2A09BE9EB5CF5082A476591AC296D40244E8DC189EFFE3B3CB6FE163BA9BE3C5F28BFA3A35B71D71D5981E7111FF47B082FA22F1918F596B4AB183BFF12EC114
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y'J.8I..8I..8I...'..8I..w...8I..@...8I..j...8I..@..q8I...$..8I...2..8I..8H..:I..@...8I..@..?8I..j...8I..@...8I.Rich.8I.................PE..L......Y............................^'............@.......................... ......i.....@.............................................................5...@...............................\......H\..@............................................text............................... ..`.rdata..&...........................@..@.data............P..................@....tls................................@....rsrc...............................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\MenuEx.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):323136
                                                                                                                                                                                                                          Entropy (8bit):6.803509283610818
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:p9m1jvoDasPczGQtjejVVsW7Apf2YZHB5dtayloL8c/FdgHqW9+c9C:pAFoDasPcFtjnHoF69d9C
                                                                                                                                                                                                                          MD5:273C2D00588D203A9F1486CABACC7C57
                                                                                                                                                                                                                          SHA1:CD7782E5836D645B2244BF30FE91C79FDCFC86D2
                                                                                                                                                                                                                          SHA-256:D14D7DE52C5749549A17E7614BD3DF8278E8595FFCA4110E6289C56A21EEA6DC
                                                                                                                                                                                                                          SHA-512:6CF37C151A21447AC35638AF22F6324ED0C10DF736E5E54BE279B5DB8F68DA86D85EF6FDFA3B4A22B2CCECD98DD37ABDC93B9E8F391A3A90DEB1E4E4990C1779
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.........W=H.9nH.9nH.9n..8oJ.9n...n[.9n..=oJ.9n..:oB.9n.4.nC.9n..8oL.9nI.<oU.9nA.nJ.9n..=oI.9n..=oB.9n..<oJ.9n..<oQ.9n..<oK.9n\.=oL.9n\.?oI.9n\.8o_.9nH.8n..9n..<oL.9n..9oI.9n...nI.9nH..nI.9n..;oI.9nRichH.9n........PE..L......_...........!................P<....... ......................................%.....@.........................@5.......5..,........C...............7.......%......T...............................@............ ..x............................text...X........................... ..`.rdata...1... ...2..................@..@.data...D....`.......:..............@....rsrc....C.......D...J..............@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\MenuEx64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):397888
                                                                                                                                                                                                                          Entropy (8bit):6.4812987990881
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:W0T3+GaWPxAe7HonHuu0LLt3i7cOTz85gW5+mQMc9fg:W0T3+G7PemHonHELWcYz8jT7c9o
                                                                                                                                                                                                                          MD5:D569954DC1054B6E7D3B495782634034
                                                                                                                                                                                                                          SHA1:DFAF57DA05704261AA54AFAA658D4E61A64FA7F2
                                                                                                                                                                                                                          SHA-256:11294E063FE9A5D5B6019A39B48BEBB75F536E27FF92008C85E9357C95805B80
                                                                                                                                                                                                                          SHA-512:B12E2A6CFE849B5DF21295F4A538DB0381F2FB8C63B8B4DFCA9778AF16C68D23336140874A64DEB324E39DA0AC52B1F2292812FD02967D415319ADE1EE965B6E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........f.....}...}...}...}...}=Y.|...}.o.|...}.o.|...}(.!}...}(."}...}.n.|...}.j.|...}.n.|...}.n.|...}.n.|...}.n.|...}.l.|...}.l.|...}.l.|...}...}...}.o.|...}<n.|...}<n.|...}<n/}...}..G}...}<n.|...}Rich...}........PE..d......_.........." .....|...l............................................... ......mf....`.........................................P,.......,...........C......d8.......7......$......T...................H...(...0........................*..`....................text...l{.......|.................. ..`.rdata..............................@..@.data....&...P.......>..............@....pdata..d8.......:...R..............@..@.rsrc....C.......D..................@..@.reloc..$...........................@..B................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\MiniUI.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):915056
                                                                                                                                                                                                                          Entropy (8bit):6.751927955871109
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:XMBX4JiaFHndgAYlDdXqXhD7O8fJ/T0ekxB:Xk6Z5dgASRXm7OI9TVkxB
                                                                                                                                                                                                                          MD5:DB2B7A54DF401E07D76E6481755FD79B
                                                                                                                                                                                                                          SHA1:99A978CB17A6935185C36279098F544D22FA287F
                                                                                                                                                                                                                          SHA-256:9100859E5959F4A130BC7DF3367D87DF3E6B208B0410010D99498BF7032F5226
                                                                                                                                                                                                                          SHA-512:4888FFA03293763127D8F90D8E816B5355EB5EA028BEFFD6FB077A39960905412E829212E1FDBF269CE49BD6B5E1104A2677FC25032CAF1079426076CEAF2E98
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=...=...=.L.....=.......=.......=...P...=...F...=...<...=.....=.....S.=.......=.......=.....=.......=.Rich..=.........................PE..L...C..T...........!.........&......1........................................@......h.....@..........................0......t................................p..`...................................H=..@.......................@....................text.............................. ..`.rdata..9b.......d..................@..@.data........@...X..................@....rsrc................t..............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\PDown.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):233352
                                                                                                                                                                                                                          Entropy (8bit):6.5499648241946
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:SzjKdi9yZhCGKesvEvcqIlV2cqd4ksXBq93:7sAhCGKe0EvcqgwT93
                                                                                                                                                                                                                          MD5:1E85022134E42C1993A94716F6A24C4B
                                                                                                                                                                                                                          SHA1:1ABA2CDD07D63EA9B261BDA0CC4325FD99C1DFB4
                                                                                                                                                                                                                          SHA-256:2E3F67EC7696CCCBC82700D973007AB52C6106C565B752341B49C4428F4FDB1C
                                                                                                                                                                                                                          SHA-512:1BF63EC311DC07B71A0BE8696BD99476E470962ADE011421E4B15F2D14EB89BD3F04083631C9FC3178DA2F9CBD1FDD2E459416AD7403A812A8EA4B7D01A71024
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..;.yZ;.yZ;.yZ2}.Z-.yZ2}.Z..yZ2}.Z6.yZ...Z,.yZ;.xZ..yZ2}.Zx.yZ2}.Z:.yZ%W.Z:.yZ;..Z9.yZ2}.Z:.yZRich;.yZ................PE..L...E..^...........!.....~...........v....................................................@.........................p................`...............X...6...p......................................0...@............................................text...*}.......~.................. ..`.rdata...x.......z..................@..@.data....H.......(..................@....rsrc........`.......$..............@..@.reloc..X)...p...*...,..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\PatchUp.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1144896
                                                                                                                                                                                                                          Entropy (8bit):6.502140433407366
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:g7fGyyeUW7ju9TjzqPoKQ+2L7uUJtAsjxy5U2dTfG2W6:yfFU2C9TjzWoK0zJtAsI5U2dTfrW6
                                                                                                                                                                                                                          MD5:B4DAA6A2FAEDD1EBC51321F718C99E38
                                                                                                                                                                                                                          SHA1:385CD2C566EBDC062BDC2FE4E17518C442CDDF9D
                                                                                                                                                                                                                          SHA-256:582D8CE0519B899513EA7DA1A84603A23A62EA7938FD67F2A2858244D531243B
                                                                                                                                                                                                                          SHA-512:E84DC7D4BDDFDA181FCB0EB7321D661FD083CB30CA3BFCE6DE85E64C99A47EE1712E45A5DA45F4FBC6E63A28F568B336B37BBEA98E9A58DBF7D6F9A5EE372844
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................`.G......D......U..............R......U............................[.....E......@.....Rich....................PE..L.....!\..........................................@.......................................@.................................\...T........R...........@...7......8.......................................@............................................text............................... ..`.rdata...4.......6..................@..@.data...|........V..................@....rsrc....R.......T..................@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\PromoUtil.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1737696
                                                                                                                                                                                                                          Entropy (8bit):6.626776585132411
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:Lyh4vwR0DxlxC8E4JiQADg9PGmnlGrrAs/T:1DxlxCJKiQ8g9rcrn
                                                                                                                                                                                                                          MD5:E398B0579E254DDB3AEB5333FEBF74C7
                                                                                                                                                                                                                          SHA1:948ECBF8527EAB15A6D27B7108CD96E8B3169DCC
                                                                                                                                                                                                                          SHA-256:879C8F5963AE1E69A59316A9E581DFE2AB825A6CB657BE2B4F39B3EECFA71181
                                                                                                                                                                                                                          SHA-512:03CC62863D2378C18E0C3591DD3E91B18EAC2EC893C668E4E5ECCA4F7997B8EC2DDA3AC8904D765FE9DB98CE6680D6FFBDDC428DC244F58278CC470AA0B20B95
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...E..E..E..*.U.E..=V.E...G.E.....E..=@.YE..=G..E.....E.....E..E...G..=I..E...W.E..=R.E..Rich.E..........................PE..L....(&f.....................~....................@.................................).....@.................................L_..|....................Z..H)..................................8...........@............................................text...,........................... ..`.rdata..,...........................@..@.data...D............x..............@....tls................................@....rsrc...............................@..@.reloc...D.......F..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHAccount.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2146784
                                                                                                                                                                                                                          Entropy (8bit):6.48382402522914
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:wPoJZZxmp8AhtYR8gL1+b0aoHU3lLQN7o181CVbHaTbIp3G+68I4sfGr0CkECQD:mT8OhgZ+wau1CVbHeIp3hPI4OdCkECQD
                                                                                                                                                                                                                          MD5:3D5B4B049E0C4B879F9C2CE1E27DFA92
                                                                                                                                                                                                                          SHA1:494FE73C910FB92FF81E8A772E61BBFB1CE09C36
                                                                                                                                                                                                                          SHA-256:41B3337A4EFFCF4153373103FE7AD13DCE99AA552EF42F9763F13EE36381E68D
                                                                                                                                                                                                                          SHA-512:FC01FDAC87314E95BAC87AD15A0EB98BE31A5BD052377026EE108403150AAEACB18527C1272D0B7B2EC4A68858FADC2C0687583A02B01F07E9FFA41B0271CFC4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y..........................5...........:j.................y...:j......:j..0.....~........x...................Rich....................PE..L....IYf............................6Y............@..........................0!.....|L!...@.....................................|....`...O............ .H)......|(.....................................@...............4............................text............................... ..`.rdata..zg.......h..................@..@.data........P......................@....tls.........P......................@....rsrc....O...`...P..................@..@.reloc...{.......|..................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHFileSmasher.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1208384
                                                                                                                                                                                                                          Entropy (8bit):6.242829141652601
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:0jwHlbKaWY6oL1T0uwJ34dW/QtQF5KXGOTBwfRzPZ15HVCjPNMOuEFcd+bZqA86C:0yHC/QtQF5kGXZPYV1BFcxAZJkwxj9Q
                                                                                                                                                                                                                          MD5:BB7275057B8024A57D701CF9534E8CCB
                                                                                                                                                                                                                          SHA1:BCB5FF939A88F3BDA1DDFD5DC87D8B9CF94A370C
                                                                                                                                                                                                                          SHA-256:A5F1583EE20BB266F3ADE2BEDF49FE1D2EC76AFAAF04D6D6B2EF9A350BB54EA2
                                                                                                                                                                                                                          SHA-512:64AF6A104798D5C6A3DDA378936E3956C92530C04388897BDA8FF408ECC6428A288AF2A5D7304655CD97B82C3357CBA7682DA26EDCAE9E1CEA7E770E078D59FB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,..,..,......,....,..B..,..A..,..W..,..-...,....,...i.,.....,.....,....,....,.Rich..,.........PE..L...._.................l..........N.............@.......................................@..................................w.......................8...7......................................... g..@............................................text....k.......l.................. ..`.rdata...'.......(...p..............@..@.data...D........`..................@....rsrc...............................@..@.reloc...!......."..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHSafeMain.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5212128
                                                                                                                                                                                                                          Entropy (8bit):6.539774226449605
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:98304:jcEEfpbp3WwVfo//MiwSF0jvB3Z8I7WiBbHT4MJ:jKv3ff8JwhjvB3Zr7D
                                                                                                                                                                                                                          MD5:6A271A1CBF219963C340A815E1DB517E
                                                                                                                                                                                                                          SHA1:4650B5831A6C456A97A3837672629057B2B7096D
                                                                                                                                                                                                                          SHA-256:0F680FE90F8DE94DE711A3015CD3A8973B4065CF650CAA7A9867D913E957625F
                                                                                                                                                                                                                          SHA-512:0B251E942E032DBE039B58C61D903D9525D8DF12E421681B5165D6A36B8BF770D9D1F4D81BDED3E5B3AABC32928141FC7537C5AA206BB476842A862E960750B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ef..ef..ef.S*..ef.....ef.....ef.....ef..7..ef.....ef....cef..eg..gf.....ef....df..7..ef......ef.Rich.ef.........PE..L......f..................=...........7.......=...@.......................... P.....\.P...@...................................H......@J..............^O.H)...0L.t.....=.....................X]B......]B.@.............=.......H.@....................text...l.=.......=................. ..`.rdata..<.....=.......=.............@..@.data...X....PH..R...<H.............@....tls.........0J.......I.............@....rsrc........@J.......I.............@..@.reloc..~....0L......vK.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHSafeScanner.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):686080
                                                                                                                                                                                                                          Entropy (8bit):6.568861006744319
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:1G+m9bQYyW0ssQwuLw6aU4RGCs6AB/l03Kle3DVmvME+OCxzn5P/q5S7ZW6DDnDg:1G+mVpS1AB/l03Kle3IvOznhS5S7ZW6s
                                                                                                                                                                                                                          MD5:CAF4FFA5EFEB186326D281BA78709CD7
                                                                                                                                                                                                                          SHA1:DCCAD16168B916EC00C12D3F0535B3D61B29860E
                                                                                                                                                                                                                          SHA-256:1EEB43C8C58B1F765B5C8D7584B7BE363112FF8695E6AA1007D90EB17BA171BC
                                                                                                                                                                                                                          SHA-512:D5D6C5B66343D368BC2112352CC9A5DE99DF45BFE6C3A80813B0B5823DB0204511CD3309ECA53CD38018F01A25B764D1456BB90FFAF91C3628C533F409709C25
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7p..V...V...V.......V..p....V.......V.......V.......V......sV...s..V...e..V...V...W.......V.......V.......V..Rich.V..........................PE..L.....}\.................6...................P....@.......................................@.................................<........`...............@..h7.......j...T..............................8...@............P...............................text...D4.......6.................. ..`.rdata..hY...P...Z...:..............@..@.data...<........N..................@....tls.........P......................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\QHVer.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15328
                                                                                                                                                                                                                          Entropy (8bit):6.934580736032789
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:OnuAg6kSDnicM+3Ps6iiXqFfL/CDLOBS+Shj2DWl6I4/C+Q3I7VDclhn8:CC6ki2cP0iwfLi0S+ShjmM6IGBkSIlt8
                                                                                                                                                                                                                          MD5:54E1E63DBF62407F43B5B201507A3766
                                                                                                                                                                                                                          SHA1:34FEB328A01823634BADA3D44C9A0AA5E4D2BA6A
                                                                                                                                                                                                                          SHA-256:7142CA565619E9269C5A1CAFADE2DE1AE741DB0D93DE2FB8D3BFDC8751EBFD72
                                                                                                                                                                                                                          SHA-512:F523BF5BF71DBA8475DD86F5DCF6E049DC3FCED327D100D4310D45047ACAA7FEBDF0D9D7EF2D14B9E14C1F5E41D08392F77F467988B1BB4BA2AFA375FC7634C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i....|..i....l..i...i...i....u..i....m..i...;k..i....n..i..Rich.i..........................PE..L......\...........!......................... ...............................`.......A....@.........................` ..M............@..H...............H)...P....... ...............................................................................text............................... ..`.rdata....... ......................@..@.data...$....0......................@....rsrc...H....@......................@..@.reloc..|....P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Repair.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1413032
                                                                                                                                                                                                                          Entropy (8bit):6.822635669207768
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:kr2P4ULguiQ62MChZ9C1zj1SqdAGFQZIxpK545UJoeIo:zMCNazjYq+ZI2a5UJoeD
                                                                                                                                                                                                                          MD5:EDAF4E0F17F44B8AC66B42C41573A297
                                                                                                                                                                                                                          SHA1:EE10CBCA23FB3CB5CC8319303D72A6DD48024FD4
                                                                                                                                                                                                                          SHA-256:C942EEA142B038D36A352015CE5346CDD4772430D014821962F30EF6B4DD9A8C
                                                                                                                                                                                                                          SHA-512:9A952EF4E42E5C7FACC2D3306E142D78D36A9A636F032AAD4B76A4E05AEE13C736505315B2590AE21B9FF20991B2CA164BE58C2B511A5CF35B8558E37BBC72BD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t)...G...G...G.MZ....G..m....G..m..Z.G..G....G..m....G...*...G...F.F.G...<...G..m....G..G....G..m....G.Rich..G.................PE..L.....\W.................p........................@.........................................................................L...|....P...Y...........Z...5..........`...................................@............................................text....o.......p.................. ..`.rdata..N).......*...t..............@..@.data............`..................@....rsrc....Y...P...Z..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Sites64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2162752
                                                                                                                                                                                                                          Entropy (8bit):6.001799015266912
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:wtvksjjbE3br5GT0m+8Au/K7YlWaP+K3uTj+F/Mocutf1I1EOBnW/9H:CMsu5GdvKa8Rw1I1E7
                                                                                                                                                                                                                          MD5:4BD489F48461DE0098F046EEB0FCFB1E
                                                                                                                                                                                                                          SHA1:047C39F1B52602EB19655C4CE42D67E8AAABEB9A
                                                                                                                                                                                                                          SHA-256:E751410539C790554EF7E3F198689B61ED06955A608DC1FCB392BB4B7FE522C6
                                                                                                                                                                                                                          SHA-512:A97929D19B9FBA341BC52BB96EEA0C97A952F3ED2E6CF233CEF9B38B3FD678F0B85C1703FE4C0D6F9C6CA3E6577716E564F92E9B36F7806AE0F5DC3C15F9CAA8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........l..?..?..?r..?..?..?..?..?..?.,.?..?.,.?..?..?..?.,.?..?.,.?..?..?..?..?p.?..?u.?..?..?..?..?...?..?..?..?Rich..?........................PE..d......_.........." .....t...................................................0!.....z.!...@.............................................................8-............ ..7.... .P...0................................................................................text...nr.......t.................. ..`.rdata..............x..............@..@.data....L...0......................@....pdata...............&..............@..@text.................@..............@.. .rsrc...8-...........P..............@..@.reloc.. F.... ..H...~ .............@..B................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ToolBox.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1402848
                                                                                                                                                                                                                          Entropy (8bit):6.537285933649544
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:dJ8HNFLQfjUUtUAToFyTaz61PxinsdRT5JE0vKf30m10w+68nvRfY+:TW2vhTcz61ksdRT5J+f30m1OznvRfY+
                                                                                                                                                                                                                          MD5:012271BD0447C9A48216EB23D93E292E
                                                                                                                                                                                                                          SHA1:438E1EF62C85251F123AFCF538F90310153798BE
                                                                                                                                                                                                                          SHA-256:A548DC1E5B3FBDFB77B120B4ED3283AB6AA2B0F0D24292FB0F6B5ECBF586E889
                                                                                                                                                                                                                          SHA-512:9F0BEC0BE97B356863D9B6AA94ADA2C4F74272F28CB5F9EC50693DAE1CC5285C0DA47AC09D5F32740678C6F0C6E342645399FBCA66AC9E28B00AF1E4DA9D6011
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........*..}y..}y..}y(..y..}y...y..}y...y..}y.M.y..}y...yX.}y...y..}y.M.y..}y..|y..}y.M.y..}y...y.}y...y..}y...y..}y...y..}yRich..}y........PE..L....f.f...........!.....\..........[~.......p...........................................@.........................P...?....a..h....p...0...........>..H)......x....{..................................@............p...............................text....Z.......\.................. ..`.rdata.......p... ...`..............@..@.data............b..................@....tls.........`......................@....rsrc....0...p...2..................@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\TraceClean.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1139432
                                                                                                                                                                                                                          Entropy (8bit):6.375215341552773
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:RHTI171IO1q8XwZTCT0X4L3ZQbGDJM+6e/r2w4:chIWqTqubGDBt/rj4
                                                                                                                                                                                                                          MD5:943CE53E4BF37DBBBF4D1F3B779C55E0
                                                                                                                                                                                                                          SHA1:E0B6461B2270F7F3E6EFC8A101D91CCB78A0CFE7
                                                                                                                                                                                                                          SHA-256:2E0A56EFE0D518BB871EFD4A37188EE83CED5D5D320BDDBC72F4DA0B6848D580
                                                                                                                                                                                                                          SHA-512:88FD73F5B304C57FB1B08233DD54611216B0314DEB9CDE051ED97A287275B400AAF807BA5CB32D4E32F431B6F4346A71F99E591EA6D1606214BB47279FD35B7A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g."L#eL.#eL.#eL.*....eL..*.. eL.*....eL.=7..&eL..."."eL.*....eL...!.$eL...7..eL.#eM.WgL.*....eL.=7.."eL.*..."eL.Rich#eL.........PE..L....d.....................<....................@.......................................@.................................0...,....................6..P,...P..... ...................................@............................................text............................... ..`.rdata..&...........................@..@.data............d..................@....rsrc................0..............@..@.reloc...c...P...d..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Uninstall.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4008928
                                                                                                                                                                                                                          Entropy (8bit):6.791550882888689
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:3iXOBG09KcDSYcGXLuB6qM6GrcWp0CoTA4jtIsA/8f5JRo+Yh8Tq:yXOnKcGrpM6WcWWTfg8f57o+4
                                                                                                                                                                                                                          MD5:CE8D5EEBEBBFCFCEB75C194FDD85E25E
                                                                                                                                                                                                                          SHA1:5E6B976EA8D9525810545060FF55514D69E81F16
                                                                                                                                                                                                                          SHA-256:ABE04940BE3AFB2B68CE425C1F476C7EB0EF8C787C3E564A37D301E23A2F8D45
                                                                                                                                                                                                                          SHA-512:5C04990BFCC1B3587C98637C786C7E3CE19E29269EE63164E4666291674685ED082C885994D07E74312B27F22024BA8B543FD49E353807E98D9D56FAE1D8BDB9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C...-...-...-.J....-.....-.....-..NC...-....".-..N@...-..NV..-...,..-.....-....Q.-......-......-.Rich..-.................PE..L...O..f.................Z&..........~ ......p&...@...........................=.......>...@.................................|.,......p.../............=.H)....;..... {&......................P).....pP).@............p&..............................text....Y&......Z&................. ..`.rdata..p....p&......^&.............@..@.data....%...0-.......-.............@....tls.........`........-.............@....rsrc..../...p...0....-.............@..@.reloc........;.......;.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360AdvToolExecutor.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):747616
                                                                                                                                                                                                                          Entropy (8bit):6.206814239832169
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:froxxe7MP6vY990AaGfVBrjMBucH+fOkEXRTrC6/mdD0o:zouYPB90Y7rjMB5/mdD0
                                                                                                                                                                                                                          MD5:809107B48FF3A7978D57D15E13E666BE
                                                                                                                                                                                                                          SHA1:23F96CB8F41BC1CD5313F8171D807B3282D83F29
                                                                                                                                                                                                                          SHA-256:FFA124D8647CF4371C4100924DBE6B323D0914115B49A24A23266F552144C01C
                                                                                                                                                                                                                          SHA-512:1CE3135907C9C9F3C0C3221DA9FBA5AFA4E9926F10969BE8DDE31381E58D0F6F10B25E1D5F20AD9691329E9F8AD8C7AF07E4770132E84A0B72AE5D1FAEC778D2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K8d..Y...Y...Y.......Y...!...Y...!...Y...!...Y..(.g..Y..(.q..Y...Y...Y...!..]Y.......Y...!...Y..Rich.Y..........PE..L....i3Z............................."............@.......................................@..................................T.......................2...5...`...,..................................(/..@...............<............................text...F........................... ..`.rdata..|...........................@..@.data...0Q...p...&...R..............@....rsrc................x..............@..@.reloc..00...`...2..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360AntiTrack.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1144040
                                                                                                                                                                                                                          Entropy (8bit):6.506917848413062
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:J/a9AxJchxOKJJch+w1NFTD+PMc9Q90sPz6XJ+6AlwnZ:lMIOcmuoWvTAMn0sPWXI/2Z
                                                                                                                                                                                                                          MD5:CCB5D0F9F8D96C447C235A76FA8D68DB
                                                                                                                                                                                                                          SHA1:06A719748F54C87C2D20CDB108DDFAE5622BBA0F
                                                                                                                                                                                                                          SHA-256:61CC32466438BB3AFA457B63FD03F9FD2A4427358787A104E0726B8553BDFE96
                                                                                                                                                                                                                          SHA-512:383DFA7E56E0470209F3E21029B589131203532C0896BE1D64D04E6C2EAAF145B67581C390F5DBEBABCD3E7422A64DFB38C7B307D45642EC5A329D80D95900EF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$........kZ...4...4...4.9{5...4..b7...4..b0...4.;.....4..c5...4.9{1...4.8{1...4..r....4..c1...4.......4..m1...4..m0...4.\x3...4..c0...4./c0...4..c1...4./c1...4..b1...4.\x0...4.\x2...4.\x5...4...5...4.'c1...4.'c....4.......4.'c6...4.Rich..4.........PE..L......d.....................<......`G....... ....@..................................[....@.....................................T....`...............H..P,......L....r..p................... s.......r..@............ ..h............................text............................... ..`.rdata...... ......................@..@.data... ........V..................@....rsrc........`......................@..@.reloc..L...........................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\360LibDrvmgr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1134
                                                                                                                                                                                                                          Entropy (8bit):7.8014602457291495
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:LhfUQHM5NH221XZoPe4f99WIgBgRZ73781j105oaDzC:LhUQs5NHR1yWq9WI8Ioj10bzC
                                                                                                                                                                                                                          MD5:A1291BDBFF46A6D313EE0CEB7FAB99D2
                                                                                                                                                                                                                          SHA1:8E45A6BFEEE9C0684F3C56FA6EEB98F2B89857B1
                                                                                                                                                                                                                          SHA-256:E6D4D1B54219EA9EACC5ACE9542415F8E8E29080138D67FEA7DCBE891748C04F
                                                                                                                                                                                                                          SHA-512:C3C8D19D34E33AB9AC84F24CB6B92C47D9CB8353D95F660DAC05C6EAAF03FC4344D08F9A19EB2100AC6900679D704D76BB4B95AAE1931CD6D83D3E3751FD47A9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.p..V/n-14}I<f:0f.+<DOH.e20.@>f"0xI.P.|.+z.D].;.._\<.3f5}gSb"<*5.0|n.?.U.d$.'...Lv.ZA..MG.=^.O...P..(........xF.kx.... .....~8..%..........K....i.g.K.P9.t.M........_.......j.......U.d.f&..@.@~.tC..+..~..x.l.d... ..z.o.ai<>..q..Go....7....F........^..U......e.({.h.. j.b.=-..3#2...S..a.0A{O.N........\$...Ol.d.dg.5....x..........`F.....8b...\.[..~.R.T...'2J. {........I...!7.y~.......&.A.9.w.......b..<..|...e.0.S..!..\..9.U.,...D.p.>vY...K....5/. w...t....Q...U{.mCJb...'z%..D...Tt.j..W....%E...y%f.P:h.......j...xO.v>..^.NM...4.p....c...9@F.f]......z..Cu.I-..0.nP...5.:S....Rk"/.<..u..*.tN.Hm-.^t.fk.2..NG.*os..gB`...@..N.......F.{......)...}:...4...1!.;.zPq....q...b.L.U...sh.T$u...t...jG.U.@8w..8}(.....2&.:.......G...........b?.y...i..x..m@..(p).]...M..?p.g.G..1..y.},:.^B.5.......]...T>A..Gn..........$.=..MA(@G..l.[......\..W.....C...pdz.L...k.....~.5H.y.L..(R..........Y.B.............YZe*.....sT.4.\(Sz..]..e..P.......]..Ty....5./..-Cu....w.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DownloadMgr.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):439688
                                                                                                                                                                                                                          Entropy (8bit):6.638159674635315
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:Uhe2bcfY3Ioj7ziFdiVB/cLEIKGJqu9TAQaLV2xWqnw9X:Q6oPzkxL9TpaLV2fw9X
                                                                                                                                                                                                                          MD5:08E9944C8613DA6FD35D2DD3253FDB8D
                                                                                                                                                                                                                          SHA1:5D7BA58497DBAF348B1C9870DB61CA74ABAA67B8
                                                                                                                                                                                                                          SHA-256:476DA4B871D76828345411D1F55CA1FF35AE91C0C6F55146C519FE384D02CCC7
                                                                                                                                                                                                                          SHA-512:65D4FDA22E51468C131BEE4A3CB17C0E8DAD8176085BFADB5FB6B8A5CB3DFEDBF33126AE6B9A2005B0D1249FBE6DBD90630132BD5013EFAE858D15611AC1FEFC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........7...d...d...d..#d...d.. d...d..6d...d..1d.d..&d...d...d...d..?d...d..'d...d..!d...d..$d...dRich...d................PE..L...,.._...........!.....4...D.......F.......P.......................................I....@.................................4........................~...6.......4...S..................................@............P...............................text....2.......4.................. ..`.rdata..9....P.......8..............@..@.data....f... ...(..................@....rsrc................,..............@..@.reloc..vH.......J...2..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DriverUpdater.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1397824
                                                                                                                                                                                                                          Entropy (8bit):6.418680319622888
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:eq9sFAxQ3x9GgJpKd/pRnba4F+9vz3OyP+DSqAA+6LsegT2tP7XAtWrGpOk9u:HHxQ3xw2pKd/Fi3OyP++qAjgsegTkUtg
                                                                                                                                                                                                                          MD5:ED08D4B6F81496EE0174868B02FE3F96
                                                                                                                                                                                                                          SHA1:56B1189E2B3711A57EBFEF5F3E66E2661FD225B2
                                                                                                                                                                                                                          SHA-256:36D8620E207ADF2F59772CF1835698E925DB5F6DE9FB213549A836912CB4A4DD
                                                                                                                                                                                                                          SHA-512:A786BA407421AAF82A683F11F641F6955B44F1207C8F7093462F36C78AC00D97CE624369F192B57C7C40888A79A8C0BE903E9E0B2242AEE3A0B88F06896FA42E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........'...t...t...t:.Zt...t..Yt...t..Et...t..Ht...t.#.t...t..Otd..t.#.t...t.#.t...t...t...t..HtM..t..Xt...t..]t...tRich...t................PE..L...p.._.....................2......{Q............@.................................].....@.................................`...T....0..T................7.............................................@...............4............................text............................... ..`.rdata...?.......@..................@..@.data...x....@.......(..............@....rsrc...T....0......................@..@.reloc.............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DrvInst64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):194144
                                                                                                                                                                                                                          Entropy (8bit):6.4184859871836935
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:SNq+IFOAPjqF0rqpNv3AWs62/waQpNVBPI7BkW+oGLE5ANB78PpYj1WICCP+5Uv/:SNgzPPup1aAZPI7BnOEaNB78xm1WIDvd
                                                                                                                                                                                                                          MD5:2DF474518017C2F1128CA122288D5407
                                                                                                                                                                                                                          SHA1:51E1AF5E20EBD47895868A3D1CF1ACD7D019C3EF
                                                                                                                                                                                                                          SHA-256:AB2D2D7B7675450E7B17EF714C5D2ECE0033C02A1383267CA4FC613897FA6D4E
                                                                                                                                                                                                                          SHA-512:99EB90F23083C4113EC39CE87F54F0B5FC379F700E95CD54201BFD084141617039042C2258BB33886A4C46CB79F2EE48754C2ABD04F3FCAA7F455EE7135FEDD5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........mU..>U..>U..>\.g>...>\.q>_..>\.`>j..>r-.>Y..>\.w>V..>U..>...>\.n>\..>K.p>T..>\.u>T..>RichU..>........................PE..d...:..Y..........".................p..........@....................................9.....@.................................................pv..........h................5......p...p................................................................................text............................... ..`.rdata...w.......x..................@..@.data....>...........x..............@....pdata..............................@..@.rsrc...h...........................@..@.reloc..N...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\DrvmgrCore.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1285512
                                                                                                                                                                                                                          Entropy (8bit):6.6884467468078075
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:r86z6k+jc1pJlYPcb/Ofo/qngIf/VJwY+P0Ehzlq1TLGZSFa+uH9S:Y6z6cgPcb/eo/qV7M4TKZSFNd
                                                                                                                                                                                                                          MD5:914F6E9C83A858134B7AAA3AAF7D61C2
                                                                                                                                                                                                                          SHA1:485FD07CB6E0DD4798D2EFD8C0EAD19C624A626D
                                                                                                                                                                                                                          SHA-256:E0323AB741FD9AA0B687AB39C4827EE67C055A3846C074435F7F5AF2D1C0F5F1
                                                                                                                                                                                                                          SHA-512:B4B8D7D2751B6E65041E13E1DF5B1B408E18B3D9AB2702DD8CDC20937F8F2EDE36E7F70491138A43224087AA83FD5A9C43742D235EAF1C67A9B7DD8101C71049
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Q.f.Q.f.Q.f.O...T.f.g.m.R.f.g.l.m.f....U.f.X...p.f.X...!.f.X....f.X...L.f.Q.g...f.X.....f.X...P.f.O...P.f.X...P.f.RichQ.f.........................PE..L....L._...........!.....F...................`...............................@.......Q....@.........................`...$............................f...6......P....e...............................................`..H............................text....E.......F.................. ..`.rdata.......`.......J..............@..@.data...............................@....rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360DrvMgr\ScriptExecute.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):537992
                                                                                                                                                                                                                          Entropy (8bit):6.594425731072702
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:oIv1nzNjApLVazhRNUJwq5JmkpcerTsCehED4V99:5ZzZMV+NiXDmkpcAT/ehQ4V99
                                                                                                                                                                                                                          MD5:6DDAAC57EF314FF52C84BC57B5D374D1
                                                                                                                                                                                                                          SHA1:DBCD2E1BE83DBE6C36389441896F7F06022098E2
                                                                                                                                                                                                                          SHA-256:B79B39BAD9AC2A8C63FD94159834AC701DEE9C07B57FC201153DF945F1080B1C
                                                                                                                                                                                                                          SHA-512:A5621406F2D974AAC884E9414EF7DCC1334207AB170B2D5CEAA317B6B62BBA1DE461B0B7D1C43FD36D28F4CBEA85D75FFE868B82B0699ABF5B34841D9364C937
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9.HlW.HlW.HlW..#..IlW.A...SlW.A...ElW.A...lW.A...WlW.HlV.xmW.A....lW.V>..IlW.A...IlW.RichHlW.........PE..L....3.^.................<..........Q........P....@..........................`......42....@.................................(K..........@................6.......B...T..............................@...@............P.. ............................text....;.......<.................. ..`.rdata..&....P.......@..............@..@.data....o...p...6...T..............@....rsrc...@...........................@..@.reloc..fi.......j..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\360WifiProtect.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1457216
                                                                                                                                                                                                                          Entropy (8bit):6.72655372591155
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:Zq0vJGpjv6bvO2mkG6qeRCZtW6GrI/ZiQjmXtvGUhpvGJGH1RTc+Wpx87Iw9Y:CpuvqrZwrAiQaJFzvGJqT5Wpx87I5
                                                                                                                                                                                                                          MD5:DF19BF3D664FA2EDB34A9F406D2863A7
                                                                                                                                                                                                                          SHA1:2BAB7BE76A1B8552FCAE78C5D296F5ADC61F9D53
                                                                                                                                                                                                                          SHA-256:0D3B603E5F07B06AFDC9F1874C16A6DCC80C37A3F8D17125259E9B6432F0C4C3
                                                                                                                                                                                                                          SHA-512:F36718B1508822327707EDC2BC5A29D8FFE7E48AC67CD3E75AC0F5F3A2CD1C9565BD491796E74CA8FADA759FE9CB346A03ADC0C0154554F1E80C78089AF5F9D5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$..........rVf.!Vf.!Vf.!... Jf.!... .f.!...!Rf.!... Of.!... Wf.!... f.!... rf.!... pf.!... Wf.!... .f.!... wf.!Vf.!Pd.!... Pf.!... .f.!... Bf.!... Wf.!..:!Wf.!VfR!Wf.!... Wf.!RichVf.!........PE..L....>._...........!.........F.......O.......................................p......B.....@..........................Y..p...`Z..,.... .. Q...............7.......... 3..p...................04.......3..@............................................text............................... ..`.rdata.............................@..@.data...h........^...n..............@....rsrc... Q... ...R..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\AntiTrack.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):346856
                                                                                                                                                                                                                          Entropy (8bit):6.556868232724109
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:17+6zsP1Q8Q0HHpuchep4xm/u9SH6/k72I8fsPa5h0OFZawWEI2YiHQofjhmRvzn:l+csQ0HHp/hLxIq/k72I8fsPABYRvzqO
                                                                                                                                                                                                                          MD5:0E7BA90F997552C070AF8EEB3479BD55
                                                                                                                                                                                                                          SHA1:5ECD375EBAD13D2EF721ACCAB1870BB161897864
                                                                                                                                                                                                                          SHA-256:4B2A5C099699985B16F265A1ECC4741FD9C2F57B8DAAF66AC203F87BFE0D984C
                                                                                                                                                                                                                          SHA-512:7F47AFB42DDB1F3D3868D52F3484CB63BF941526D53F034DDA19FDD14EA4DB47DA69523DC73047497B76D38149D8CB8C963571C66FDAE7C3B2B24DE78CA1BA2D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$............n..n..n.r.o..n.Z"...n...m..n...j..n.p....n.\.o..n.r.k..n.s.k...n......n...k..n...j..n...k..n.^.j..n.d.j..n.^.k...n.d.k..n...h..n...o..n..o.i.n.Q.k..n.l.k..n.l.n..n.l...n.....n.l.l..n.Rich.n.........................PE..L......d...........!.................7....... ...............................P............@............................P...@...........................P,... .../..Pm..p...................`n.......m..@............ ...............................text............................... ..`.rdata...... ......................@..@.data....6.......(..................@....rsrc...............................@..@.reloc.../... ...0..................@..B................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\AntiTrack64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):439528
                                                                                                                                                                                                                          Entropy (8bit):6.238751675871995
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:0YdP8UFUBrXh+jQ6dyS0CVcLmkRFEocNHPY7kMJPxo:08tqlx+jRyS0CVcLmkRaPQ7zc
                                                                                                                                                                                                                          MD5:1269C80F900329DD986CF0FF61609F85
                                                                                                                                                                                                                          SHA1:79DDC1F043EA2F328DD8089DF4129CC77E4C1FC3
                                                                                                                                                                                                                          SHA-256:0C7F9E863F8A9EDA11990A131496B14AEBBA4EFCEE1F047E7B22314D33304F84
                                                                                                                                                                                                                          SHA-512:5A797B87891164A6A6FFD6C1CC699AE2B936AB14A09CF809A3E8A6FD4760CEFC7771E541B0823BAB4D5F172557195B621E8346776D77EF8A1D8480D3EE974967
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.........A.../../../....../.$|.../..+../..,../..@.../..@.../."..../...*../...*../...*../...+../..*../. .+../...+../. .*.../...*../.i..../....../...*../.../../....../..../...-../.Rich../.................PE..d......d.........." .................L..............................................sg....`.............................................P....................`...L......P,.........../..p...................@1..(...@0...............................................text...|........................... ..`.rdata...L.......N..................@..@.data...PQ.......:..................@....pdata...L...`...N...*..............@..@.rsrc................x..............@..@.reloc...............~..............@..B................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\CondrvFix.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):132776
                                                                                                                                                                                                                          Entropy (8bit):7.417979470281181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:kdRGsvFggQcyz3nYVQSY6CQPCkjkK8d8AKgTnfV/9R:k5CYVZFCQPXUGHm9R
                                                                                                                                                                                                                          MD5:EE99A8DF97443B9A42CE28C9E4B81AE6
                                                                                                                                                                                                                          SHA1:B434D08CC74CA99CC2EADA6B933B3626139DDD1B
                                                                                                                                                                                                                          SHA-256:5826C791A86ACE09A2A9C2D5B9AA5D5A32057C2D821FB68C980FFD0E6AECAE4C
                                                                                                                                                                                                                          SHA-512:603EB6F55B950D2DEBB8400008FDBDDE6DD4754429E4550AE9697D35E67612A3F8C0E5E889D0E2C3162B6B06310CC26FA7C7B96EC358D5914BB08293C80F993C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F..v...F...@...F.Rich..F.........................PE..L... ..\.................b..........(3............@.......................................@.................................0........P...f...............7...........................................................................................text...w`.......b.................. ..`.rdata..P............f..............@..@.data...8............z..............@....ndata.......P...........................rsrc....f...P...h...~..............@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\DesktopPlus.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2753768
                                                                                                                                                                                                                          Entropy (8bit):6.387350183525537
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:IFJi+7OytIt34Ehz1/dggLOkJAwYzlbFks7CYVmyoZEhaTnMtSYXkNgj:IFJi+ayqxdggLBAjl97CymyougMdR
                                                                                                                                                                                                                          MD5:7186838BEC4478B234B432D264658F10
                                                                                                                                                                                                                          SHA1:5CE0F57D2D176E89FD345CAA30E1F0DE0F63E24F
                                                                                                                                                                                                                          SHA-256:E2FA4A52FFBEC327E8678FB584CD6573C7966737251E6AA3CAD113D63C3CA0E3
                                                                                                                                                                                                                          SHA-512:6F1BA31675177C0AAE4BC9CC65690B9F52ABE2292173D7A12BF8816ADA6593B9546DCB7E27CCEC4B592ED42CAD785E0572A8B4DBFF2978C1D7D0DC0F5CDD9D3B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........nd.............h@.......w.......]........d.......g.......q..............w.......w..=....w.. ....].......w......Rich............PE..L...x*.f.................`...r.......F.......p....@...........................*.......*...@...................................!.h.....#..g............).P,...@(.pH...|................................ .@............p.. ............................text...._.......`.................. ..`.rdata..l....p.......d..............@..@.data...<....@"......*".............@....rsrc....g....#..h...4#.............@..@.reloc..*8...@(..:....'.............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\DesktopPlus64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3783912
                                                                                                                                                                                                                          Entropy (8bit):6.188478443667849
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:yIqnYWKGWPPvjMM3jTcfsCnJqVlwoS4Y6KPJRQFqvpQP3TRTi:n3jYNvdhWG
                                                                                                                                                                                                                          MD5:ADDB69F9A976B47243ED7C621C7E5C10
                                                                                                                                                                                                                          SHA1:6F0D78C32984B7DC764DF183B76802F2C2203A11
                                                                                                                                                                                                                          SHA-256:40920438EB1B105449B565D669CBC7F74A7C8499A1EBDC683BBF62499C222A5F
                                                                                                                                                                                                                          SHA-512:4ABA4C7FF23371D667506DA3A2D0C9BBC165070F7E2A66341B27EECE3301C3C1723F96850D8266859C144932232CA1B4DE1057883CA0CFD9DE026A492344C953
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._cqD.............M......<.......P.......z......<.q.....<.r.....<......<.d.(.......N....z.......z.......z.......P.......z......Rich....................PE..d....+.f..........".......'.........."#........@.............................p:.......:...@...................................................0.h.....5..g....3.4f....9.P,... :..$...((...............................................(..............................text...^.'.......'................. ..`.rdata..0.....(.......(.............@..@.data.........1..\....0.............@....pdata..4f....3..h...@2.............@..@text....^....p5.......4.............@.. data..........5.......4.............@..@.rsrc....g....5..h....4.............@..@.reloc...M... :..N...@9.............@..B........................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\Utils\360ScreenCapture.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):684096
                                                                                                                                                                                                                          Entropy (8bit):6.575312225999228
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:8k1udOg+5XvJComqEAUQLk//b43pPonzLCETseJVo:8kkY1BtEAoHApyzL5Tw
                                                                                                                                                                                                                          MD5:050132ACE215B38E8311E8F3FC11A6F2
                                                                                                                                                                                                                          SHA1:CCAECAF99D9B8ACAFD1632E3735B89D567AF5112
                                                                                                                                                                                                                          SHA-256:234184EE1C37F28EF75A950501E91D6B55C829F66B96696A1A8E83A09BDBE883
                                                                                                                                                                                                                          SHA-512:21B4D364A3EA965ADF7A697F70F64AD6CA660BF0BC6A664DEC00918D4529BF647B36E2F3268EC0F59D7B51F3B6C55D573D45EC2026849DC51B376DC59F59E736
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........jBF...F...F...O...j...X...B...O.......O...[...a<i.G...a<..g...F.......O...&...X...G...O...G...RichF...................PE..L...=..[..........................................@.................................|.....@.................................|...T....`...............8...7...@...5.................................. ...@............................................text............................... ..`.rdata..,\.......^..................@..@.data...(V.......*..................@....rsrc........`......................@..@.reloc...F...@...H..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\Utils\360searchlite.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):936960
                                                                                                                                                                                                                          Entropy (8bit):6.5665988215910565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:cRwv6RBAJ5UP0Yyj4kflQaiZD5wlVUU0KKg3:SLGwPD5Gd07g3
                                                                                                                                                                                                                          MD5:85F76A8481C642654AE58CAF6D1B35A0
                                                                                                                                                                                                                          SHA1:5925A1F3A265311E8D818407062DDF5CEFFFAC3F
                                                                                                                                                                                                                          SHA-256:81399A7379AEBBBFBCE8D8CBC2D482CA04C38DDC91919AE5C6EE3A0F8FB3EA9B
                                                                                                                                                                                                                          SHA-512:7DA2F2550B4BCAD5A5DF5033C44635722724ED68FE97FA9E383032432283AC43E3DBEB0F4080368F86D2E2B54B91A166F5E6280C35F0AE7E8AF3E31C478FB48D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t....Y.u...}.Z.W...j.K.q...S(..u...}.L.....S(..s...S(..o...t.......}.E.d...}.K.....j.[.u...}.^.u...Richt...................PE..L......\.....................h....................@..........................p............@..............................................U..............h7......|e..P...............................@...@............................................text............................... ..`.rdata...g.......h..................@..@.data...Pg...0...@..................@....rsrc....U.......V...R..............@..@.reloc...i.......j..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DesktopPlus\Utils\search_file_type.json

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1054
                                                                                                                                                                                                                          Entropy (8bit):4.498856395947475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Oq/yo/XbA3PCZneewP+R0C+tDAwizIh1NSJklV:Opo/rgCZfwbftNizgHU6
                                                                                                                                                                                                                          MD5:28B79C423115A9F4C707C22B8FD33119
                                                                                                                                                                                                                          SHA1:61D190717506E84ECE4BB870562E8B8885A2A9C3
                                                                                                                                                                                                                          SHA-256:D1B7BC9A125CF0FFC0996BDEDEC5E1FA724212FAB340103CEB5BC1BE3C25E686
                                                                                                                                                                                                                          SHA-512:4689FA3E9DB913CC2F17488A110D6B56E434F686C830A42CAED51E5A545CA15EED83436C4073E1FDC8CB9E4B88203E0F9278006C5C1376C22A6B2D2608930F41
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:{..."doc": "doc|docx|dot|dotm|pdf|xps|htm|html|mht|mhtml|xml|txt|rtf|wtf|odt|xls|xlsx|xlsb|xltx|xltm|xlt|csv|prn|dif|slk|xlam|xla|ods|ppt|pptx|pptm|pot|potm|potx|ppsx|pps|ppsm|ppam|thmx|ppa|",..."pic": "bmp|jpg|jpeg|png|gif|tif|tiff|dib|psd|eps|raw|pxr|mac|tga|vst|pcd|pct|ai|fpx|cal|img|wi|eps|ico|cr2|crw|cur|ani|",..."zip": "001|7z|a|apm|ar|arj|bz2|bzip2|cab|cpio|cramfs|deb|dmg|epub|esd|ext|ext2|ext3|ext4|gpt|gz|gzip|hfs|hfsx|hxi|hxq|hxr|hxs|hxw|ihex|img|iso|jar|lha|lib|lit|lzh|lzma|lzma86|ova|pkg|pmd|qcow|qcow2|qcow2c|r00|rar|scap|squashfs|swm|tar|taz|tbz|tbz2|txz|uefif|vdi|vmdk|wim|xar|xip|xpi|xz|z|z01|zip|zipx|",..."app": "exe|bat|msi|",..."movie": "asf|avi|wm|wmp|wmv|rm|rmvb|rp|rpm|rt|smi|smil|m1v|m2p|m2t|m2ts|m2v|mp2v|mpe|mpeg|mpg|mpv2|pss|pva|tp|tpr|ts|m4b|m4p|m4v|mp4|mpeg4|3g2|3gp|3gp2|3gpp|mov|qt|f4v|flv|hlv|swf|ifo|vob|amv|bik|csf|divx|evo|ivm|mkv|mod|mts|ogm|pmp|scm|tod|vp6|webm|xlmv|asx|cue|m3u|pls|qpl|",..."music": "aac|ac3|amr|ape|cda|dts|flac|m1a|m2a|m4a|mid|midi|mka|mp2

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\DuplicateFile.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1233640
                                                                                                                                                                                                                          Entropy (8bit):6.508860602556125
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:ui1ZNBp9G35phhuZ+1+4ZA5cq1Zd9CqdhAzwPFImdTbdnY:XFBKz2IYcq1b9CqdKuImdTbdnY
                                                                                                                                                                                                                          MD5:F9DF1C5DAD49489C44DC630AD7DDD2B6
                                                                                                                                                                                                                          SHA1:72C454B57EE61B051780522F398F6AB459138F9D
                                                                                                                                                                                                                          SHA-256:2D803542F2DD3B985248C172B1149A0C08ADDB8BE6938DC4014007D682B72E0B
                                                                                                                                                                                                                          SHA-512:488E8F0F3BF139B5DFF79610F89E0DC3218B4CDEF540D1ABEE08F19847B68CFCB7B539E428E3ECD7AF7E7319B1D5D233906EC6A49AE61F20D6B92F1C3EA73273
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......$.U*`.;y`.;y`.;y..8xr.;y..>x..;y..>xd.;y...yd.;y2.8xy.;y..>xc.;y..?xj.;y2.?xC.;y2.>x2.;y..?x}.;y..=xa.;y..:xK.;y`.:y..;y..2x%.;y...ya.;y`..ya.;y..9xa.;yRich`.;y........................PE..L...io.e.................&...z.......G.......@....@..........................0......j.....@.................................<...T.......X`..............P,...`..L.......p........................... ...@............@...............................text...l$.......&.................. ..`.rdata.......@.......*..............@..@.data...0....@...b..................@....rsrc...X`.......b...~..............@..@.reloc..L....`......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\ModuleUpdate.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):589424
                                                                                                                                                                                                                          Entropy (8bit):6.5418510867771875
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:DoNWXWUvZZa9J+FWY3aGSPO6R9J6qt/2vfo9TqGVH8:DKYuZZwqteY9TqGc
                                                                                                                                                                                                                          MD5:3ABC35D52E7264B8612719147A11D5F7
                                                                                                                                                                                                                          SHA1:A23B8983077F66EC3CC10CA726560B64EF739437
                                                                                                                                                                                                                          SHA-256:870748FA3829E6C6FE35F0120F3F2AA7520A7AA0B713C015B2475077A23E13BE
                                                                                                                                                                                                                          SHA-512:58FED1D2CBD1D4CC055F7DCBB5A2B0B54C4A60E959E917B0D24F151E06659846934284689EC07BE58762A2852ABE41E021A5CD56D1021549410A3B3B6D4194EE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'..Fj..Fj..Fj......Fj..>...Fj..>..Fj....Fj..>.Fj......Fj......Fj..Fk..Gj..>..Fj......Fj..>...Fj.Rich.Fj.........PE..L...f.T.................b........................@..........................@............@.....................................@....@..L.......................|=..................................8P..@............................................text...``.......b.................. ..`.rdata...Q.......R...f..............@..@.data...\\.......0..................@....rsrc...L....@......................@..@.reloc...N.......P..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\PopTip.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1275872
                                                                                                                                                                                                                          Entropy (8bit):6.586727869532933
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:8RMe0bB4KI9Ib/RbHX45BQXenReR45bQwKW8t+vAsPvNKy+6G/be0TSfZjI:pOIlSiunckbRKfoAsPFKFp/be0T+jI
                                                                                                                                                                                                                          MD5:724B65AAC84CDD35743EB62C2734D28A
                                                                                                                                                                                                                          SHA1:3AE6F5D05E4B8F140C51D1DCC1908C58E848050B
                                                                                                                                                                                                                          SHA-256:37C2164C3C368362FA5988759EBF6FCE265E4A4A68C67F0F42701B29851B3A8B
                                                                                                                                                                                                                          SHA-512:2955A1F9678B7E4301E7FACB2B2D997A8CAB91AC5B63CBAB8EE6B68CD8A4022CB3D155DEB6829035731B2AF8D05CFBFE54B677ADAD76E1662EDA3FAC612436F0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6z..r...r...r....j..p... s..~... s..q....Y.~....r..p....j..T....j..v...{c>.p....r..v....l.k....r..i...3|..q...3|..x....i..s....r..b....r..!....r..x....r..`... s..~....i..v....i..s....i..Y...r...>....r..|....rT.s...r.<.s....r..s...Richr...................PE..L.....Vf.................v..........`.............@..................................{....@.................................|........P..`............N..H)...........k..p....................l.......k..@...............T............................text....u.......v.................. ..`.rdata.."-...........z..............@..@.data............Z..................@....rsrc...`....P......................@..@.reloc..............................@..B........................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\PowerSaver.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):148552
                                                                                                                                                                                                                          Entropy (8bit):6.549878182487373
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:C2JW9le6e4g0iWLdf/3Q8YfkqiXk+bbRbcj9FXxY7LAr3lzi:nJW9k4zLdf/3Q8gdsk8cjLhYQJ2
                                                                                                                                                                                                                          MD5:A99CC896F427963A7B7545A85A09B743
                                                                                                                                                                                                                          SHA1:360DEC0169904782CFE871BA32D0ED3563C8FA62
                                                                                                                                                                                                                          SHA-256:192B065887382E2755B2223B6A956FF1670B78D561012E0B1CBF862D90B46559
                                                                                                                                                                                                                          SHA-512:5D745F0E9F10C24382948DF7363424C6BAA0DDE6FB6A446BC6490BCFE4167D40ACBFA1E2B1EBB0CA60595E59AD309DEF6FF3A4E8C8F23AC38FD6190F9B9A3285
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$.......... ..ds..ds..ds.9.s..ds..gr..ds..er..ds..`r..ds...s..ds...s..ds...s.ds=.er..ds=.ar..ds=.`r..dsy.ar..ds..br..ds..er..ds..esg.ds..`r3.ds..gr..ds..ar..ds..`r..ds..ar..ds6.ar..ds..ds..ds..mr..ds..s..ds...s..ds..fr..dsRich..ds........................PE..L.....H[.................8...................P....@..........................p......7.....@.....................................P.... ...-...............7...P......`...p..........................P...@............P..<............................text....6.......8.................. ..`.rdata..Np...P...r...<..............@..@.data....(..........................@....tls................................@....gfids..............................@..@.rsrc....-... ......................@..@.reloc.......P......................@..B................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SimpleIME.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):187392
                                                                                                                                                                                                                          Entropy (8bit):6.198991928300617
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:7V0Dy01wyOGl0p/a7cLiPPjLz+3C54NpShO3jmpFv:Bj1Za7cLiXXIvNpaqy
                                                                                                                                                                                                                          MD5:47A3459C7B41E93B279FAA05BB792DA2
                                                                                                                                                                                                                          SHA1:2AAEC9BE6BD963775D266DA411258DEBBEDD67AD
                                                                                                                                                                                                                          SHA-256:BC28985EB55A3F78CA9B20FE84D570FE63ADD8846C7D529E126CC00A214984AA
                                                                                                                                                                                                                          SHA-512:2BBBF787949003504B950ADDF2E87CD4322F1AE61D4807C40CE838A7AF2C5A21BF0DC1AD71590E5CE971151C4EC31F0140C7273FE8746B2B5B38470719BF55EF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............dC..dC..dC...C.dC...C..dC...C..dC.O.C..dC.O.C.dC..eCq.dC...C.dC...C..dC...C..dCRich..dC........................PE..L...>..\.................V...H......0........p....@.................................$2....@.............................................$...............h7......t....s..................................@............p...............................text....T.......V.................. ..`.rdata...G...p...H...Z..............@..@.data....2..........................@....rsrc...$...........................@..@.reloc..D".......$...~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SiteUIProxy.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):356416
                                                                                                                                                                                                                          Entropy (8bit):6.465138857076493
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:XsTEQD4zJ2lo5iYMHHb4iGb9LdDR6tL2EZoEN4b2oHN0L9c:cTEQDi2EiPH7QR6F2EZPN4b2Y0L9c
                                                                                                                                                                                                                          MD5:36F88DA8AB5C25A1655AD0AAEBB2AE50
                                                                                                                                                                                                                          SHA1:467ABE06651B6D5B30204C012162090868F4C050
                                                                                                                                                                                                                          SHA-256:0574B9283D232BDEAC7C53CC86C5A89435D52FF399039CF5BB304628BE286A6F
                                                                                                                                                                                                                          SHA-512:184C1F130717C7E235FB08DBD265D1D2A8E67D106081553A00F66AFC10E80ED4B756386A9717F6051E9ECAD81EAA236DDDD8D863D425F55D996BA713F99FE5CB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@.............A...................m.....@.....................C.......U......./...................................Rich............................PE..L......`...........!.........<.......................................................[....@.........................`.......D........0...............8...7...@...1..@...............................0Q..@............................................text............................... ..`.rdata..?...........................@..@.data....h.......<..................@...shared..P.... ......................@....rsrc........0......................@..@.reloc...I...@...J..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SysCleaner.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1149288
                                                                                                                                                                                                                          Entropy (8bit):6.464887733835036
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:/PnMU7vq6NhCeuqf4sPvoz7o+6E6Yo8zNWMFTcGiSQaRrGUt:nz7NNs44sPvmoF/Yo5JDSdB/t
                                                                                                                                                                                                                          MD5:21E6A9A8FC4780ACFBB257B0BB5A5382
                                                                                                                                                                                                                          SHA1:131619CE6BDEC4030184BBBA7747CD40D1397C5F
                                                                                                                                                                                                                          SHA-256:E99348BCAFD68E6170A20DFCF85FC59045C3EED3D26D57575E6701F7F78952F7
                                                                                                                                                                                                                          SHA-512:B3C24C2FFA09C43304E137153C864FCE771D296B4EE4E8BBE09193AD282E8B8475FF9C2235693EBC5FD2349F0522053189D1F4C5001D79D09383799C2201B506
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.........5..[...[...[...Z...[..._...[...X...[...^...[...^...[......[.@B....[...^...[..._...[...^...[.......[..._...[..._...[...]...[...Z...[...Z...[...^..[..._...[...^...[...[...[......[......[...Y...[.Rich..[.................PE..L....S]...........!.........4......P........0............................... ............@.........................@>..T....>..@....P...I...........T...4.......y...n..p....................o...... o..@............0..0............................text...W........................... ..`.rdata.../...0...0..................@..@.data...x....`...@...N..............@....rsrc....I...P...J..................@..@.reloc...y.......z..................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\SysCleanerUI.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):924000
                                                                                                                                                                                                                          Entropy (8bit):6.4484096653097405
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:2Yb8j7Sx5XctS7CaZ6H3il8eg4wysPeqH4N/zfkRp5G:nnstSWaZ6XiKSwysPelN/k5G
                                                                                                                                                                                                                          MD5:A7E3CB500EE56B376D40DE18D31DACBF
                                                                                                                                                                                                                          SHA1:BC89BAD1E8B491C904AFCB55AA695E39CEFDAF58
                                                                                                                                                                                                                          SHA-256:185AD85AB85BE5175BB9A8BFBDB969D8D93897561058C1F065938FC37004F8A8
                                                                                                                                                                                                                          SHA-512:55EDF5C77D89DD5CD9FFDB192F1E3CC4F2294F9F78D7AA59777104CECCCD911891619163E050F6C211DD9B77C5EBD0D7ED8F8D647541BA37048D15FD723EC7C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........:./.[x|.[x|.[x|o.y}.[x|Y2y}.[x|.3|}.[x|.3{}.[x|.=}}.[x|.7}}.[x|.#.|.[x|^2}}.[x|P..|.[x|]2}}.[x|.<}}.[x|.<|}.[x|.=.}.[x|Y2|}.[x|Y2}}.[x|.3}}.[x|.=|}.[x|.=~}.[x|.=y}.[x|.[y|.Xx|V2}}.[x|V2.|.[x|.[.|.[x|V2z}.[x|Rich.[x|................PE..L.....S].................p...n.......)............@..........................0.......$....@..................................q..T....0...m...............4......X....x..p....................y......@y..@............................................text...Go.......p.................. ..`.rdata...............t..............@..@.data............T..................@....rsrc....m...0...n..................@..@.reloc..X............T..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\cef\2623\icudtl.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10207936
                                                                                                                                                                                                                          Entropy (8bit):6.147523774437582
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:196608:L+7mOUgAjk3MVMP7mxl2b+2WYZjU15obkTQ89kxgc3bbHo4QY7iUT0ep:evWjk3mMP7mxl2b+2WYZjU15obkTQ89a
                                                                                                                                                                                                                          MD5:D03AD9A1189D190119209072D048E428
                                                                                                                                                                                                                          SHA1:AA954098E3AE4C00F67BACE45B39A7B4A8242C6A
                                                                                                                                                                                                                          SHA-256:2857FBE46D007307B1E204C6EB1B7E4988973B958EC8EDB07445988F332C1AB5
                                                                                                                                                                                                                          SHA-512:4F73A2C0CEEF525E5947DC6EEB7608DB40E535EEADB37D83842BDD638EB4D9114F3654D8094C0B72C66AE4BB0214B0947CD4FE2B56426F778C07F3CAC5FAEA21
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:...'........CmnD........ Copyright (C) 2014, International Business Machines Corporation and others. All Rights Reserved. ...............\.......^......._..................$... ...4.......E.......U...`...l..../..|....Z.......\......p>................&...... &......!&.'....(&.A....)&.X....1&.o...p2&.....P7&..... :&.....0.'......u(......C*.....p",.%....+,.C...@,,.\...`.,.s..../,.......,.....P/-......./.....0\/.......0.......0......A0.*...`C0.@....g0.U...0.0.j.....0......51..... Z1......1.....@ 2......r2.....Pr2......r2......t2.3...Pu2.K....u2.`...@.2.v.....2.......2.......3...... 3.......3.......3.....`.3.....P.3./.....3.D...` 4.\.... 4.q....:4.......4.......4.......4.....P.4.......4.......4.......4.......4.7...@.4.L...P.6.a.....7.v.....;.....@8;......\;......x;......x;......;.....@.;.. ..0.<.! ....<.6 ..pn<.K ...n<.c ..0o<.x ...<.. ....<.. ....<.. ...<.. ....=.. ..p0=..!...0=..!..@1=.2!...1=.J!.. 2=._!.. .=.t!...=..!....=..!....=..!..@.=..!....=..!....=.."..0.=.,"...">.I"..@#>.f"..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\cef\2623\libcef.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48950888
                                                                                                                                                                                                                          Entropy (8bit):6.989062190578095
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:786432:lIdLhtZuz/Uir7+l4lFz+tS0fu/AwIoLhxMdQz82hiLMlnd9uEZFe5lSzTPDi:OhyzzKl4lFz+tSsu/Ajo1xMWz82hiLMu
                                                                                                                                                                                                                          MD5:E7F79EDE8CC1ED9FDA5AEEAE77E19953
                                                                                                                                                                                                                          SHA1:135D05BDC23C4A6F90C8057843D93E03CB1A7717
                                                                                                                                                                                                                          SHA-256:AF6BFD525C81961F77DA85E99AFAC8462F5693081F73732EA0FBCEFB93B4A867
                                                                                                                                                                                                                          SHA-512:0172ECD6887DD641803A559161DCF18EEBA1E536398F537211A364DFAC3EAEFEF4A5F30B95771D6165F771A5C708F5F97DF6BFED50B477325DD3CCBEB961D7F3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$..........C...........K....jom......u......J......K............J......O.S..)0{....)0z....)0e....)0d....)0a............K......v......q......=......t....Rich...................PE..L.....5W.........."!......?..B.......M........@...........................................@..............................................................5......L.....@......................).......(..@.............@.....$........................text...H.?.......?................. ..`.rdata........@.......@.............@..@.data....p...0......................@....tls................................@....rodata. ...........................@..@_RDATA.. ...........................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\cef\cefutil.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11299392
                                                                                                                                                                                                                          Entropy (8bit):6.179099315377953
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:196608:y6T+7mOUgAjk3MVMP7mxl2b+2WYZjU15obkTQ89kxgc3bbHo4QY7iUT0el8:y5vWjk3mMP7mxl2b+2WYZjU15obkTQ83
                                                                                                                                                                                                                          MD5:81CBD2C27C1202CF9DFB8374366F24B9
                                                                                                                                                                                                                          SHA1:C55322C4E81BF96C3A1C451A9B2C2836A8B67D1A
                                                                                                                                                                                                                          SHA-256:F6BDE459185AFE2D5B3A220D3693B7F3CC9E940234F7F9C923244DCB4701160E
                                                                                                                                                                                                                          SHA-512:670D79A08525554BA56D90F2A0B16EC2202269949C9826CC0B4DADE2F926ABD2A5C828E4A1DB884C7B0F486E7BEC639F7BBB50477D95BD2123E92365801BBD0A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}f..}f..}f...)...f..t...[f..t...f..c4..xf..Z...{f..Z...^f..t....f..}f..3d..t...Pf..c4..|f..t...|f..Rich}f..................PE..L....C.`.....................X......V.............@.................................E!....@.............................................,f...........2...7..........@...............................(...@...................L...@....................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...,f.......h..................@..@.reloc...>.......@.................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\cef\ver.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Windows setup INFormation
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19
                                                                                                                                                                                                                          Entropy (8bit):4.0374011976541135
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:gfl4Qyn:gfXyn
                                                                                                                                                                                                                          MD5:1DA2ADB833894AE9EB8A3E90364819FB
                                                                                                                                                                                                                          SHA1:301BCE50AE8AE44BD5033CF58C454D6BD94444DC
                                                                                                                                                                                                                          SHA-256:95446CC85C28B111CA058FF80B1DA91023693263A25E448C18CFE26070CFE620
                                                                                                                                                                                                                          SHA-512:724464465977465E73A7FE5712CA814163E05B25BF9A3BD37E82FBBB47125253DC9163F4300BCE25CEC57A05D245DDF1EE59806471945B3013B4F84AD60227C2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:[VERSION]..all=2623

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\Utils\lang.lang

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6746
                                                                                                                                                                                                                          Entropy (8bit):6.220411518230176
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:cLGrHzv6xnOznOToGo+XX0WrIn9uqcIk+Ne+BZ66iLCj1yuS:cLGrHzixn0nqXXyhcIk0D66NjsuS
                                                                                                                                                                                                                          MD5:E414616EDC9C54DC51BABB9A65C30CFD
                                                                                                                                                                                                                          SHA1:6AD7AE62A908A076E6FE05725EA538A22CB739D1
                                                                                                                                                                                                                          SHA-256:B1D16D59FBAAAB04F51AAE8C03488CBBB0236357B624391A2AADB3CB7F05A1CC
                                                                                                                                                                                                                          SHA-512:F5F1390D42F202D5AEADB71C24D2F3173B5EF8A0B6C2C0FB9BC9B5485E2607989A5A137E7E515D63BF57A898EB49D7F38145756DFD69E8244382085DA9D0B845
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:......CHS....d.........e...s...WiFi.......................VPN...........f.......DNS.............................VPN...........g.........VPN..CHT....d.........e...t...Wi-Fi.......................VPN...........f.......DNS.............................VPN...........g.........VPN..DE....d.....Zeig das nicht noch einmal.e.....Ihre Sicherheitsstufe des WLAN-Netzwerks ist schwach. Es besteht ein Risiko der Preisgabe von Daten. Schalten Sie bitte VPN ein, um Ihren Internetzugang zu sch.tzen!f.....Ihre DNS-Adresse hat sich ge.ndert und Ihre privaten Daten k.nnen dadurch gestohlen werden. F.r einen sicheren Internetzugang schalten Sie bitte das VPN ein!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\act.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):993
                                                                                                                                                                                                                          Entropy (8bit):5.6277125957250345
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:PB4AfoR1y0spXIJotaOsrjbr3B20ZHFJUJotaOpJbypA9cBpJmipGxJ1:WwZVXIJlOKB2KHFJUJlO/2XB/HwxJ1
                                                                                                                                                                                                                          MD5:0914618BCA857F401DECBAF492D12F92
                                                                                                                                                                                                                          SHA1:399EBC873A2B9C56245F1DF1D4415592781AAACB
                                                                                                                                                                                                                          SHA-256:AEBE21E5EECD017F308AA8A73E80D7B5A8BE22F577E76EAC60FDC47410A67312
                                                                                                                                                                                                                          SHA-512:FC7C31C26688ED3BDD3648AEE8486FB893CDE33E9F8A8A06822FF524EFDDDFC462FA0B24FC6166BF7B6A915C8B5E6BC60600A2C081C5D231CCCC787A2B6CDE11
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<......................................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOLy.$1$. 1e.,+!.1*7 . 1xg....~..~g{eHOLLydhhhey!$1$.!e.-0('57,+1xg.....&}sqq}q}s|!qt!w'u!vwvt|&p$sw#|vtp$$#w&'!ge. 6*07& .!xgtge.,+!.+.1*7 xgoge.0'/ &1xg.05 7#,6-ie.+&kge.660 7xg.05 7#,6-ie.+&kgej{ehh{HOLyj.$1$. 1{eHOLHOLy.$1$. 6*07& . 1{HOLLydhhheHOLLy +{HOLLLy. 6*07& e.!xgtge.,6..$( xg.$+" 7*06e.05 7.,6-e. 71,#,&$1 ge.,6.. 6&xg.$+" 7*06e.05 7.,6-e. 71,#,&$1 gej{HOLLyj +{HOLLHOLLy?-h..{HOLLLy. 6*07& e.!xgtge.,6..$( xg..........05 7.,6-.....ge.,6.. 6&xg..........05 7.,6-.....gej{HOLLyj?-h..{HOLLhh{HOLyj.$1$. 6*07& . 1{HOLHOLy.,6&. 6*07& . 1{HOLLydhhheHOLLy +{HOLLLy. 6*07& e.$( xg.&$+.+#*ge. =1xg.<61 (e. 71,#,&$1 gej{HOLLLy. 6*07& e.$( xg.) $+.<5 ge. =1xg.0"" 61e. ) 1 gej{HOLLyj +{HOLLHOLLy?-h..{HOLLLy. 6*07& e.$( xg.&$+.+#*ge. =1xg..........gej{HOLLLy. 6*07& e.$( xg.) $+.<5 ge. =1xg..........gej{HOLLyj?-h..{HOLLhh{HOLyj.,6&. 6*07& . 1{HOyj.**1{HO

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\cacert.pem

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):232597
                                                                                                                                                                                                                          Entropy (8bit):6.0091385497779415
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:u2PLl0vnlF+kkUNl1ROWAqcfCNkuSE2F9l3:zLlcldxVNkial
                                                                                                                                                                                                                          MD5:899BC667A911B03DBD8361C30A6262F3
                                                                                                                                                                                                                          SHA1:80B1CDEF778478F76167FC58F6829134A8C108E6
                                                                                                                                                                                                                          SHA-256:5319E72357F628CFBD063CC5CE56DB9CC0BE8250A8F44CCC8EC673EE1FC08B2E
                                                                                                                                                                                                                          SHA-512:5B8B3B7CC182ED617C5BDA138C12B4D00F78E7802085436DE4585FD157F9BDFA62CE5EB35590C81817AF28BD983972F0EE6DDF98AB25C3AF6DE6EB9E5D8D8A6B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:##..## ca-bundle.crt -- Bundle of CA Root Certificates..##..## Certificate data from Mozilla as of: Sat Dec 29 20:03:40 2012..##..## This is a bundle of X.509 certificates of public Certificate Authorities..## (CA). These were automatically extracted from Mozilla's root certificates..## file (certdata.txt). This file can be found in the mozilla source tree:..## http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1..##..## It contains the certificates in PEM format and therefore..## can be directly used with curl / libcurl / php_curl, or with..## an Apache+mod_ssl webserver for SSL client authentication...## Just configure this file as the SSLCACertificateFile...##....# @(#) $RCSfile: certdata.txt,v $ $Revision: 1.87 $ $Date: 2012/12/29 16:32:45 $....GTE CyberTrust Global Root..==========================..-----BEGIN CERTIFICATE-----..MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9HVEUg..Q29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlcl

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\defaultskin\MiniUI.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8726
                                                                                                                                                                                                                          Entropy (8bit):3.743828031532119
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:uqaDq5DF0THCIDUrg8ScjN/cIGuDg0yRqfJyzoJ1sJE0LoyjPRcUwj8jVcxsuJTx:8kYJArDGutyofFmTLoUYuVme76D2h9q
                                                                                                                                                                                                                          MD5:97BB23EC30C1601A62674EA618018AC8
                                                                                                                                                                                                                          SHA1:D3C4381292DA345B79316B0FD0DD30F75A274357
                                                                                                                                                                                                                          SHA-256:78470A187BF698270269B556F9D2DD1B6DEF3B4803B78004C9A780F74809D530
                                                                                                                                                                                                                          SHA-512:FD1FDB08DC70B790E11EBA7B201FBEDBBE1C477BE6CC317A2C620C7F436D674796B3D5AADB9595AD689E84066C751ECC749A64B044D493B1593271D040C13A4E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.M.i.n.i.U.I...C.o.n.f.i.g.>..... . .<.D.e.f.a.u.l.t. .R.e.s.P.a.t.h.=.".C.o.m.m.o.n.". .M.s.g.I.c.o.n.I.n.f.o.m.a.t.i.o.n.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .M.s.g.I.c.o.n.W.a.r.n.i.n.g.=.".m.s.g.b.o.x._.i.c.o.n.i.n.f.o...p.n.g.". .X.p.F.o.n.t.=.".T.a.h.o.m.a.,..[SO". .S.k.i.n.N.a.m.e.=.".....v..". .D.e.f.F.o.n.t.=.".._o...,.T.a.h.o.m.a.,..[SO". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.F.r.o.m.=.".R.G.B.(.2.5.5.,.2.5.5.,.2.5.5.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.T.o.=.".R.G.B.(.2.3.8.,.2.4.6.,.2.4.9.).". .r.s.s.V.i.e.w.S.h.a.d.e.C.o.l.H.e.i.g.h.t.=.".5.0.". .B.a.c.k.g.o.u.n.d.P.n.g.=.".".>.<./.D.e.f.a.u.l.t.>..... . .<.D.Y.N.A.M.I.C.T.I.T.L.E.B.A.R. .S.y.s.M.e.n.u.B.i.t.m.a.p.=.".3.6.0.S.a.f.e.-.1.6.n.e.w...p.n.g.". .F.o.n.t.I.D.=.".N.o.r.m.a.l.B.o.l.d.". .H.o.v.e.r.T.e.x.t.C.o.l.o.r.=.".0.x.f.f.f.7.e.c.". .C.l.o.s.e.B.u.t.t.o.n.=.".s.y.s._.b.u.t.t.o.n._.c.l.o.s.e...p.n.g.". .T.e.x.t.C.o.l.o.r.=.".

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\defaultskin\defaultskin.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3304
                                                                                                                                                                                                                          Entropy (8bit):7.538657810177453
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rcP1kvnLXSpkmpb0J3y8SA3c0aUph54+JCF9vmyyIZzOz4spojyLmPex6asEOU69:oaMrb6S+FhyBmyyuM8e6XOBDOwxq
                                                                                                                                                                                                                          MD5:60CA0ACDEAD9C4BE83A1A5811732FD08
                                                                                                                                                                                                                          SHA1:271B6E2414DEAC1DC4EC100F149BC3A0F95A87A6
                                                                                                                                                                                                                          SHA-256:EF82AF2F455251C1DB24D7028CE3332BD5ABF284383EC751B7777D6532DD24A4
                                                                                                                                                                                                                          SHA-512:49A3DE6A9AC4334932661CE518DE032BE514839FDD1E09C926622877BD478B53705F894ED5094BE34912D8E50A722932C7D76A9B47A8F6754840F361C2034AB4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........B.=P..x............Common/radiobutton.png.PNG........IHDR...............6N....tEXtSoftware.Adobe ImageReadyq.e<...xiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e17ad449-6dc3-48f6-8615-03e99c896a03" xmpMM:DocumentID="xmp.did:F76CB5A1461811E4BA1FFA5C8B7D971F" xmpMM:InstanceID="xmp.iid:F76CB5A0461811E4BA1FFA5C8B7D971F" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:027e3900-785a-438a-97ef-4fec02487858" stRef:documentID="xmp.did:e17ad449-6dc3-48f6-8615-03e99c896a03"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\lang\ru\SysSweeper.ui.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):133003
                                                                                                                                                                                                                          Entropy (8bit):7.998395116229545
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:x1vjMCOTHhJp/iIVpxwetvAxXq+wsMfes8aOhUa4AzWoa:x1vjMCKHfp/iQNYxXqE4Aba
                                                                                                                                                                                                                          MD5:7CAC038A7AB169AB1D1F1DD60A1ADC10
                                                                                                                                                                                                                          SHA1:D3DAC7D0EEC04EC7175AC9099D672E9414F9BA89
                                                                                                                                                                                                                          SHA-256:769629935EFDFA35F286469896C9C5391CB1C94F72E2BF50BE8142463B817D1D
                                                                                                                                                                                                                          SHA-512:FF67DC68968EAE715B407DB3B32E075E678CDE02E200BE76D20FE2F261F1ADA55A0259C11E01139A5EDAAEEA1977E0C39EE8547B8A1A47D5C206720B08B3BA48
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.p..t.@..,.,.q....`...E....S.)p......n...K..=.J.7BZa.z....6.D........QZ.1.X...L...+...a2.n4.............O...L.#s.t..<..bzA.Z...w..$. y2.G-..q...`..%\....1..q..M~..j:.@..g..!w...,m_..;k../.T./ZRY.b.......\.8a*.....ID.:.^O..P...%B...'..4<c.....y...aF..y...iG.9......Na<...)v..+L...".A~..X.*.l..-A.i........;.H..p.8.#h4.K....8.8.bK..T...!F...#..08...25.i..hG..p...%uK..1=.E.z.. <.....,.9T.f..?..o<..d.."c..6.......'Ct../gX..XJ.>...(|...gI...Vv..QOA.7...$~Q..P....}.. ....R..;.^.wF...z....Y..W.cQ.._6.x".LF...K..&t...#.B}...55._.3...${T..cD.>..)..p...a...J4.@..'.:6.\.e..+%.....W.0_.o..6{..d+..u%.-...."....^O..@f.5.h..m_.4...%F....+e....,.:.K..1Ol.u..=..%.q.....~..^U...r....l.d..~...k\..Y.k2..."..=....zU..]O. .Cu.'x.......1..R.x..1....<.J.{..c..).._%.........}....r\...l..?y...REV..[...3.m;..G.9.[..84.B.c..)'...,.U.2].i..4u.f%..}!.#u..8......Wx..@f.5.."..H..YN..Lc:c..69.m..TK..t...)}...V.|.=...* .N.w....5..[!.D........o@.-C...43.n6...#.......9... .J..-..t..Cd;d

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\lang\vi\SysSweeper.ui.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):105000
                                                                                                                                                                                                                          Entropy (8bit):7.998242938683701
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:gx0yYtEZcQdagD9jvoXKG1GSzJ2Nids/FVt3Sjw3gsV:y01ECQTjvJYwTlu7M
                                                                                                                                                                                                                          MD5:342017BDEC8DC449D9D4BB7887F4CE10
                                                                                                                                                                                                                          SHA1:2B0A93ECA0CB95472868944DEDF0FDFB6DC63F74
                                                                                                                                                                                                                          SHA-256:1C5C9F768F871141DD765B9CF59BA16972F2048201AF9BFFC4265C530F404157
                                                                                                                                                                                                                          SHA-512:78B50A9FD9E69D66B2A5DFA5C03238FAE677A18E429C527F7B932ABFEADC27D87C6383C53F33B6F7A75182A9C8FA3308E94D959A836B9544B4D73F39A581C5A0
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.p..t.@..,.,.q....`...E....S.)p......n...K..=.J.7BZa.z....6.D........QZ.1.X..4.I.[.u..]2.Y.f..z8.B.t3.J..Q..:._.hI...{....Z..T.`V..\..{#.PX..:rD...2.T.j..J,.{..E#.D.....#.@.;NFe.~..2..:.H........UX...j......f..7.{..H?.G.y..U;.H..V>.K.4j..,.U.,[UZ.c....`.._.;f+....HE.2{^..#uB..}...6..}.....p.%.(D.R.........<.E."M...$e3.V....1.;.O..2.Z..e.....v..-.~..?.U..h..X..b..;..Z.`.9...&$.2.s..{.1..W-.@....>..$h......;.G.1v..1.T.iR.P.1{..+.Z.u...%.M.r..84{....$..,.~.....w4..j...}...)e....:.Q...>.O.....F..e....,...;7._.d..l..$..D..t..,...=sC..%j).N.z....y.<..V.d..7..V.|.=...* .N.w....5..[!.D........A....E.S.W..Q.[.`K.Q.c....$.A....l.z..3..-.y..u ._R..w....m.........G.o.a...$.P..w....^....A.i...>.J....jA.5e../.^..9b5.@...5..l.1.R....Y.b..1=.E.z.. <.....,.9T.f..?..o<..b..#vI..,.-..d...9..E.j..h*.l..b%.x.g..H.M..[......;.L..B.d..B...5..d....l...X/.7.I.%e..X..f..[.$z....%..keJ.S.f..p../.+v;.\$..x..#e...*y...i...".^.zA..*./.x....k.s..*..$.pF..l9.@k..@I..*xK

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360AV\360AV_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):301511
                                                                                                                                                                                                                          Entropy (8bit):4.251580130051337
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:XJzALaQglzQ14KJCEtArc8BNfwn3C7DvpglEN0fWxOHfDZAa+k33qZr:5e1KFjTZr
                                                                                                                                                                                                                          MD5:38871E866871EFFF3F2A6BBA63A8ABD6
                                                                                                                                                                                                                          SHA1:376E1DB821B747677FF12ECA7DDDDC97E133D270
                                                                                                                                                                                                                          SHA-256:95735196E09A5912E8593FA94EB775B2C85EF7B85884D306D725C01112C27653
                                                                                                                                                                                                                          SHA-512:1823BE663D1B528D1546779BCF93CE2C368728B3FC1317361A6AC6ABC84230E8F2213B34E66AD75690C701EA722CEAA6705A5DB4A8F69A6B046FE3E9B61714DC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........,].J................DPI_240_image/PK........,].J.0.'-...-.......DPI_240_image/onaccesstip_g.png.PNG........IHDR..............y.C....tEXtSoftware.Adobe ImageReadyq.e<...piTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:401232CDC24611E5ABD6EE04C0598C1A" xmpMM:DocumentID="xmp.did:8F76FABA0DF411E6941FDEE39F2EB7DE" xmpMM:InstanceID="xmp.iid:8F76FAB90DF411E6941FDEE39F2EB7DE" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:73e00d06-7e57-403d-a2f2-5b765eb2160c" stRef:documentID="xmp.did:401232CDC24611E5ABD6EE04C0598C1A"/>

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360AntiTrack\360AntiTrack_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184005
                                                                                                                                                                                                                          Entropy (8bit):4.698112153018556
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:2qvhJO5QDEakqaazGLqLcNC05FP/wDwhNyyK:xJJO5QDEakqzGLQ8CUxYDwhNy3
                                                                                                                                                                                                                          MD5:7184B152D9585ED65F794567CCBDD4A4
                                                                                                                                                                                                                          SHA1:2D6E34804145DAFFC99EB4393DFDFD010F2756CD
                                                                                                                                                                                                                          SHA-256:95043AC58CF8252BE28AC1A06E1BDD257FBB0F62ADA2760FC0FAA359791ECD5A
                                                                                                                                                                                                                          SHA-512:6D53874D83D2D063D874F20F4EBA61364E09648BFABAD5AA9E3B127BB489276C7AA8C97AF007ED41CABD446FB0194EC6BDFF46D1F8A22AD40EB84B215ACA2E9A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........a..R................Image/PK........;.<RX'pD............Image/browser_chrome.png.PNG........IHDR...0...0.....W......hIDATx....6...'...W<^.y...g.q..w\q..g.q..w.q..{l...w..8;J.....)....;>...........'.<.iR..b...(......4)D.'.[.4.}..9./.,...-A$.<+..^...3..;.H.....,..gg.R....[...k.).j .g.<..0...6.8.s." ........3...Q.Ay....$...}...d...P.8...`..F....(.......(@q...no...=.Sp5.(..F..y..P..`...........t.*_........-..`.]...I................=...4.L.NP.. ..W.*l..v.#L..;........D.X.L..}.1.Tq......q.S......g.a.\!.q +....UP..`..!t`..@....TG..Jk...".......(..Vc.de)9%Rp....F%'..|_..h..z..{...'EqtC....v.W.. .D.@.~..JM.....].sJ.....a.~#\4p.DQv.x....w)..}].. ~.S.k..H.Jz.K....@W=.QPR&d6.2..S!.....Q...$.a.............Gy....z.<.jC@..|:j.W...Yu./.O.....4G1...|C...}...S....Oz.<2..6D;...QfP(A%....+u...6.....%5o-i ...M...R.B.\.R&.<y....^..B....B...u..Xy.....V..K...*Y.......x>..._e......\.=.X}.t.8+o..~......GXR..p.(.\..o..f...U.....n.G.U`.=..:..W..x.....0.....-3.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360Central\360Central_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):582953
                                                                                                                                                                                                                          Entropy (8bit):7.149605997960401
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:jYp1dePxAZXidGQk3qjx48n+xkL1Q0a76Jx8pvVFTt6pb54pQ6gB+pCzJJXtgrp3:GEAllxElNe0rERVdt8Ia4pC9xyrp3
                                                                                                                                                                                                                          MD5:FEBD9F086B1ADD21E352EF438B7599BD
                                                                                                                                                                                                                          SHA1:86906167E5F259F5AEE687B8472C17E529E9BC5C
                                                                                                                                                                                                                          SHA-256:DF0DAFAB3C224C96E7A0E8C9FB6D2542EDB0625D2F27D08227AE5C360BE9C358
                                                                                                                                                                                                                          SHA-512:A3FB304FD82AA60899E476EA23E04B34C265E47C7BAC1AFBF5B163DE2A6FE7484951351C2DBA736498AE58A7F908423BDBF8CB6A6A8279075C16E4F16CF484F7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........d>K................DPI_240_image/PK.........h3K............#...DPI_240_image/360connect_camera.png.PNG........IHDR.......d.......fw....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:f631376f-639b-40c9-88e8-e0b0d3d94a71" xmpMM:DocumentID="xmp.did:263C722E925811E6A336CE5B40A96D6F" xmpMM:InstanceID="xmp.iid:263C722D925811E6A336CE5B40A96D6F" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9871d545-f454-4c17-97c8-9ffe506d9844" stRef:documentID="adobe:docid:photoshop:ce518d42-b9

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360EvtMgr\360EvtMgr_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):77121
                                                                                                                                                                                                                          Entropy (8bit):5.507826158422031
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:j6HW1gS78TJ1kmnYDiTvaQ7Dnzmz+rbVHLzdlQ5KD4FVLMa6i:LNUjzUWaQ7mz3
                                                                                                                                                                                                                          MD5:0463311D64DE607DEE248C9B24C75BB6
                                                                                                                                                                                                                          SHA1:1CA851A30AD439F42966EC1EE9BB25B79F421BFF
                                                                                                                                                                                                                          SHA-256:EE1AA27B15EC4046478F851350463C5D6FE28AAC7C53CE3176F1E1DF18EA8128
                                                                                                                                                                                                                          SHA-512:DB2D8622444DF93B82EEAE9491D7998BA2241270CA33E441ABE21487E201E34664F64C138E607BB93C7B2F5AC3E56B453D6D39A0AC63C333D7A938FD96BB453A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK...........R...*............CloseDialog.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>.......<.r.e.s.o.u.r.c.e.s.>.........<.i.m.a.g.e.s.>...........<.I.D.I._.B.T.N._.D.O._.I.G.N. .p.a.t.h.=."...\.3.6.0.E.v.t.M.g.r.\.I.m.a.g.e.\.b.t.n._.d.o._.i.g.n.o.r.e...p.n.g."./.>...........<.I.D.I._.M.I.N._.C.L.O.S.E. .p.a.t.h.=."...\.3.6.0.E.v.t.M.g.r.\.I.m.a.g.e.\.i.c.o._.c.l.o.s.e._.m.i.n...p.n.g."./.>...........<.I.D.I._.P.I.C._.S.M.A.L.L._.W.A.R.N.I.N.G. .p.a.t.h.=."...\.3.6.0.E.v.t.M.g.r.\.I.m.a.g.e.\.p.i.c._.s.m.a.l.l._.w.a.r.n.i.n.g...p.n.g."./.>.........<./.i.m.a.g.e.s.>.........<.s.t.r.i.n.g.s.>...........<.I.D.S._.3.6.0._.T.I.P.S.>.............<.z.h.-.C.N.>.3.6.0..c...`<./.z.h.-.C.N.>..... . . . . . . . .<.e.n.>.3.6.0. .r.e.m.i.n.d.s. .y.o.u.<./.e.n.>. . ..... . . . . . . . .<.z.h.-.T.W.>.3.6.0..c...`<./.z.h.-.T.W.>..... . . . . . . . .<.r.u.>.3.6.0. .=.0.?.>.<.8.=.0.5.B. .B.5.1.5.<./.r.u.>...........<./.I.D.S._.3.6.0._.T.I.P.S.>

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360InternationSafe\360InternationSafe_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9263024
                                                                                                                                                                                                                          Entropy (8bit):6.339494041995779
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:98304:2+Ewl7b1Kk6qaSvruF+l5omkUUBE86i/g4onTAP6NAt5R:2+EQfkSruUXjkUd86W4/ajR
                                                                                                                                                                                                                          MD5:AA95DF00490E546DCAB7821EA0AB53E8
                                                                                                                                                                                                                          SHA1:7B71FE1525D2E7E75915ECFFAACF523E59ABE700
                                                                                                                                                                                                                          SHA-256:E70E553B4AFEF223C819AA1A4DF5289D98D2B195A4E8A7A86879209640D04834
                                                                                                                                                                                                                          SHA-512:20433DA36C5D422C2455DB358CFB1C7FE18B17EC9C5ACDA6E3C1947C4E8CF1BF5FE0FA7FFE17A9C8189E128E6F9BB317DED1B83D9B9E362215620BB7A9384D83
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........n.#X.O.v0B..0B......about_dlg.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>..... . . . .<.w.i.n.d.o.w. .R.e.s.o.u.c.e._.t.y.p.e.=.".". .a.n.i.m.a.t.i.o.n._.s.e.t.t.i.n.g.=.".s.h.o.w. .i.n.f.l.a.t.e._.l.i.n.e.a.r. .1.0.0.,.h.i.d.e. .i.n.f.l.a.t.e._.l.i.n.e.a.r. .1.5.0.". .b.o.u.n.d.=.".0.,.0.,.4.1.2.,.4.0.2.". .i.d.=.".0.". .s.c.r.i.p.t._.e.n.g.i.n.e.=.".J.S.c.r.i.p.t.". .s.c.r.i.p.t._.p.a.t.h.=.".". .s.t.y.l.e.=.".0.x.9.6.0.2.c.0.0.0.". .s.t.y.l.e._.e.x.=.".0.". .t.h.e.m.e.=.".w.i.n.d.o.w._.m.a.i.n.". .t.i.t.l.e.=.".".>..... . . . . . . . .<.p.a.n.e.l. .a.n.c.h.o.r.=.".0.". .b.o.u.n.d.=.".0.,.0.,.4.1.2.,.4.0.2.". .c.a.t.e.g.o.r.y.=.".{.A.C.E.9.4.4.1.1.-.E.3.F.B.-.4.4.C.8.-.B.D.2.C.-.F.E.3.3.0.3.C.C.E.B.3.B.}.". .c.o.n.t.r.o.l._.s.t.y.l.e.=.".0.x.0.". .i.d.=.".1.0.0.0.". .i.i.d.=.".{.E.D.5.A.6.2.5.2.-.F.4.4.9.-.4.5.E.9.-.8.2.5.E.-.C.2.7.E.9.8.A.2.6.3.5.9.}.". .i.m.a.g.e.=.".". .m.a.r.g.i.n.=.".0.,.0.,.0.,.0.". .s.h.o.r.t

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360InternationTray\360InternationTray_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1374520
                                                                                                                                                                                                                          Entropy (8bit):6.555037119403722
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:ybpCj/c8o9bpfuZnhMipxVqe+gY4fEpOcWEHBUXP:eCD7obmZn3goBP
                                                                                                                                                                                                                          MD5:8B6D541292DAEAC20AD7BF57DB5B2DD6
                                                                                                                                                                                                                          SHA1:7D3463BCF6132FF98647E211E9391BEF67AA13F5
                                                                                                                                                                                                                          SHA-256:28B071D4944531234B64BFA1BB9068C64220EE48C8A60AFA3AACE2A69A599198
                                                                                                                                                                                                                          SHA-512:BFF97AAE10D792619DD2C118855F8D8554B14B130C7F1E533F4FBB8680BA9D9A08F8D15C4CD4EEE2417CAE0BB3C347876E778F2075C85C6F87A104A511306802
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........NNV@.. ... .......bootup_ad.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>..... . . . .<.w.i.n.d.o.w. .R.e.s.o.u.c.e._.t.y.p.e.=.".". .a.n.i.m.a.t.i.o.n._.s.e.t.t.i.n.g.=.".". .b.o.u.n.d.=.".0.,.0.,.3.0.0.,.1.0.0.". .i.d.=.".0.". .s.c.r.i.p.t._.e.n.g.i.n.e.=.".J.S.c.r.i.p.t.". .s.c.r.i.p.t._.p.a.t.h.=.".". .s.t.y.l.e.=.".0.x.9.6.0.2.c.0.0.0.". .s.t.y.l.e._.e.x.=.".0.". .t.h.e.m.e.=.".w.i.n.d.o.w._.p.o.p.u.p._.n.o.t.i.t.l.e.". .t.i.t.l.e.=.".".>..... . . . . . . . .<.p.a.n.e.l. .a.n.c.h.o.r.=.".0.". .b.o.u.n.d.=.".0.,.0.,.3.0.0.,.3.5.0.". .c.a.t.e.g.o.r.y.=.".{.A.C.E.9.4.4.1.1.-.E.3.F.B.-.4.4.C.8.-.B.D.2.C.-.F.E.3.3.0.3.C.C.E.B.3.B.}.". .c.o.n.t.r.o.l._.s.t.y.l.e.=.".0.x.0.". .i.d.=.".1.0.0.0.". .i.i.d.=.".{.E.D.5.A.6.2.5.2.-.F.4.4.9.-.4.5.E.9.-.8.2.5.E.-.C.2.7.E.9.8.A.2.6.3.5.9.}.". .i.m.a.g.e.=.".". .m.a.r.g.i.n.=.".0.,.0.,.0.,.0.". .s.h.o.r.t.c.u.t.=.".0.". .s.t.y.l.e.=.".0.x.1.8.0.0.0.0.2.0.". .t.a.b._.i.d.=.".0.".

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360UDisk\360UDisk_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):239027
                                                                                                                                                                                                                          Entropy (8bit):6.139600313341595
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:zr7ltDvFrNS2r+oGlHBjT34YQIKCeBLT+05HPY+zj7LiAdkdlGvBY:zr7lpvFrNS63Gpz4YQIKCeLzX/7Lwdl7
                                                                                                                                                                                                                          MD5:D87CFBA66A6E96C2FE296CB459320A3F
                                                                                                                                                                                                                          SHA1:11B959C973A27179692E8D97B4E0B595316ADFF2
                                                                                                                                                                                                                          SHA-256:51FFAA15C7D2BE0E4DB83E3695D10453390F69AAE7AC6D7AFB0B6C078CF0B877
                                                                                                                                                                                                                          SHA-512:3C03C76505C342A19A77D4AAD840E8BF74DA144D065E720B4438A87000491300F4C96D68770E5F67F836594BB32F4E60764CDC64CDA8229ABAFEFDD835E270A9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........U.KW....O...O......dlg_UDiskFloating.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>..... . . . .<.r.e.s.o.u.r.c.e.s.>..... . . . . . . . .<.i.m.a.g.e.s.>..... . . . . . . . . . . . .<.I.D.I._.S.C.A.N._.B.A.C.K. .p.a.t.h.=."...\.3.6.0.U.D.i.s.k.\.i.m.a.g.e.\.u.d.i.s.k._.w.i.n.d.o.w._.0.2...p.n.g."./.>..... . . . . . . . . . . . .<.I.D.I._.D.I.S.K._.I.C.O.N._.S.A.F.E. .p.a.t.h.=."...\.3.6.0.U.D.i.s.k.\.i.m.a.g.e.\.u.d.i.s.k._.i.c.o.n._.o.k...p.n.g."./.>..... . . . . . . . . . . . .<.I.D.I._.D.I.S.K._.I.C.O.N._.D.A.N.G.E.R. .p.a.t.h.=."...\.3.6.0.U.D.i.s.k.\.i.m.a.g.e.\.u.d.i.s.k._.i.c.o.n._.w.a.r.n.i.n.g...p.n.g."./.>..... . . . . . . . . . . . .<.I.D.I._.D.I.S.K._.B.T.N._.O.P.E.N. .p.a.t.h.=."...\.3.6.0.U.D.i.s.k.\.i.m.a.g.e.\.u.d.i.s.k._.b.t.n._.o.p.e.n...p.n.g."./.>..... . . . . . . . . . . . .<.I.D.I._.D.I.S.K._.B.T.N._.R.E.M.O.V.E. .p.a.t.h.=."...\.3.6.0.U.D.i.s.k.\.i.m.a.g.e.\.u.d.i.s.k._.b.t.n._.p.u.l.l.o.u.t...p.n

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360hipsPopWnd\360hipsPopWnd_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):228817
                                                                                                                                                                                                                          Entropy (8bit):6.940502447389389
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:zNK4NRfL+5q3RMXfhafxnSoH5gg5fOEjWeTTPv5UwR8s4gbgO07rSd86I:zNHL7RMXfRa5fOIBZBR8XqgdPSU
                                                                                                                                                                                                                          MD5:162F022B7260A0040E1E6DB1E69369DD
                                                                                                                                                                                                                          SHA1:984A53E332C7397F40A10E6AE53C5A686767F5B1
                                                                                                                                                                                                                          SHA-256:EB5E123169B609D442D4293FBA610083E141E277DEED9D40FCDBE94D8E074E14
                                                                                                                                                                                                                          SHA-512:39943E49651F64F14D148394796C50E44092387213B4250BF5E6D1F60A9336C85C8FA6E0864CE03821F5D5805CDAE9F4481130D9E64C769B76F1CED1B82BD7F9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........}.aT................DPI_240_image/PK........}.aT#.1x|...|.......DPI_240_image/hips_btn.png.PNG........IHDR.......K.............tEXtSoftware.Adobe ImageReadyq.e<...piTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:353938ed-10ed-4f17-b27f-4161b7a91126" xmpMM:DocumentID="xmp.did:820BFB25C24D11E5ABD6EE04C0598C1A" xmpMM:InstanceID="xmp.iid:820BFB24C24D11E5ABD6EE04C0598C1A" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E70B3E4C821111E5A3DFE46AC72D61D4" stRef:documentID="xmp.did:E70B3E4D821111E5A3DFE46AC72D61D4"/> </rd

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360leakfix\360leakfix_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1041510
                                                                                                                                                                                                                          Entropy (8bit):6.908939106581601
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:x3y9XpPKKDAJrJE4aqMNKLiQGPkycxji8AMAmRNyuLMA/1knm:x3y7PKqAJrJEPqGzPkXA8CwMA5
                                                                                                                                                                                                                          MD5:151AA41AA007F7D0146538C1A2832B8E
                                                                                                                                                                                                                          SHA1:7036ADAB73B90BE15C0F2C20FBDFBC8333F51063
                                                                                                                                                                                                                          SHA-256:B1C0C2B2077101ECF9B9FFFFD9B78663501993483D12D95FD942E8133D1C4CD5
                                                                                                                                                                                                                          SHA-512:BB6688DCEAB20C3B658F64C4778A73F14565DF25BB9FD47C317D0152872F394D3E47D888601460A009B6FBC4449DFE711A1C8F42815721258617CF29B4BD7A1C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........&VmM\4.,.e...e......detail_page.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>..... . . . .<.w.i.n.d.o.w. .R.e.s.o.u.c.e._.t.y.p.e.=.".". .a.n.i.m.a.t.i.o.n._.s.e.t.t.i.n.g.=.".h.i.d.e. .i.n.f.l.a.t.e._.l.i.n.e.a.r. .1.5.0. .". .b.o.u.n.d.=.".0.,.0.,.5.0.0.,.2.9.0.". .i.d.=.".0.". .s.c.r.i.p.t._.e.n.g.i.n.e.=.".J.S.c.r.i.p.t.". .s.c.r.i.p.t._.p.a.t.h.=.".". .s.t.y.l.e.=.".0.x.9.6.0.2.c.0.0.0.". .s.t.y.l.e._.e.x.=.".0.". .t.h.e.m.e.=.".w.i.n.d.o.w._.p.o.p.u.p.2.". .t.i.t.l.e.=.".".>..... . . . . . . . .<.p.a.n.e.l. .a.n.c.h.o.r.=.".1.5.". .b.o.u.n.d.=.".0.,.0.,.5.0.0.,.2.9.0.". .c.a.t.e.g.o.r.y.=.".{.A.C.E.9.4.4.1.1.-.E.3.F.B.-.4.4.C.8.-.B.D.2.C.-.F.E.3.3.0.3.C.C.E.B.3.B.}.". .c.o.n.t.r.o.l._.s.t.y.l.e.=.".0.x.0.". .i.d.=.".1.0.0.0.". .i.i.d.=.".{.E.D.5.A.6.2.5.2.-.F.4.4.9.-.4.5.E.9.-.8.2.5.E.-.C.2.7.E.9.8.A.2.6.3.5.9.}.". .i.m.a.g.e.=.".I.D.I._.D.I.A.L.O.G._.B.A.C.K.G.R.O.U.N.D.". .m.a.r.g.i.n.=.".0.,.0.,.0.,.0.". .s.h.o

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360liveupdate\360liveupdate_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):186792
                                                                                                                                                                                                                          Entropy (8bit):4.2260905098455765
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:3RjGaLQw68UGZa0AaG+DiSz07sfTQ/pUkPr60QCzRD:hisQw64a0BDiSz07N/ikPZQCzN
                                                                                                                                                                                                                          MD5:D0F8D1DB2D2B04FA9738D08707297F74
                                                                                                                                                                                                                          SHA1:722D4E43D9C7A9F54C0DBF9696199538B294AEB4
                                                                                                                                                                                                                          SHA-256:DA00018F703370B0B51EFCAA12CA47FB4A0FB423DF506F92BB8E16A04D029AA0
                                                                                                                                                                                                                          SHA-512:4354B7F58FA82C08B241D5FC9B6C344CB1D1B6E606070DA549BF4A891FF2EFB9877F01C52D2D2513B2BD61FE41816CF4B63AE5B1892611EF4DE693C9542E96B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........+].J................DPI_240_image/PK........+].J.%./........-...DPI_240_image/com_download_manager_top_bg.png.PNG........IHDR..............O......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:974482EFCC8C11E4B470CEC725CD2D0D" xmpMM:InstanceID="xmp.iid:974482EECC8C11E4B470CEC725CD2D0D" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3011BD172E8C11E4993CBCBCF654DAC3" stRef:documentID="xmp.did:3011BD182E8C11E4993CBCBCF654DAC3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360sandbox\360sandbox_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):325345
                                                                                                                                                                                                                          Entropy (8bit):4.451531537316983
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:fKuFG4MMSdlA10dXfExJ0fTTbD54+4dlZ4KvMpuvt:fRGnUMQF
                                                                                                                                                                                                                          MD5:A8CB4A639D867CF7CBE3A725E23E4FF5
                                                                                                                                                                                                                          SHA1:DF84964258C46D8925F6BE12FCB262942BAF1A0C
                                                                                                                                                                                                                          SHA-256:F2BD2BEF47BE3758F3622C517B2BDEC4A57836148FF51F0B61847D69D3DCAE32
                                                                                                                                                                                                                          SHA-512:46D6D318DFB074AB84A531F195D7BE1319FA7DB458463BE33F673E0CE10CC95DC92FBEB2B6E7F8A239AC7F0AADDA64DD4620FC54D85506C9888081AAE066CAE3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........Em.KN..w............applist_page.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>..... . . . .<.w.i.n.d.o.w. .R.e.s.o.u.c.e._.t.y.p.e.=.".". .b.o.u.n.d.=.".2.1.0.,.3.6.,.9.0.0.,.5.8.6.". .i.d.=.".0.". .s.c.r.i.p.t._.e.n.g.i.n.e.=.".J.S.c.r.i.p.t.". .s.c.r.i.p.t._.p.a.t.h.=.".". .s.t.y.l.e.=.".0.x.9.6.0.2.c.0.0.0.". .s.t.y.l.e._.e.x.=.".0.". .t.h.e.m.e.=.".I.n.t.e.r.n.a.t.i.o.n.S.a.f.e._.d.e.f.a.u.l.t.". .t.i.t.l.e.=.".".>..... . . . . . . . .<.p.a.n.e.l. .a.n.c.h.o.r.=.".1.5.". .b.o.u.n.d.=.".0.,.0.,.6.9.0.,.5.5.0.". .c.a.t.e.g.o.r.y.=.".{.A.C.E.9.4.4.1.1.-.E.3.F.B.-.4.4.C.8.-.B.D.2.C.-.F.E.3.3.0.3.C.C.E.B.3.B.}.". .c.o.n.t.r.o.l._.s.t.y.l.e.=.".0.x.0.". .i.d.=.".1.0.0.0.". .i.i.d.=.".{.E.D.5.A.6.2.5.2.-.F.4.4.9.-.4.5.E.9.-.8.2.5.E.-.C.2.7.E.9.8.A.2.6.3.5.9.}.". .i.m.a.g.e.=.".". .m.a.r.g.i.n.=.".0.,.0.,.0.,.0.". .s.h.o.r.t.c.u.t.=.".0.". .s.t.y.l.e.=.".0.x.1.8.0.0.0.0.0.0.". .t.a.b._.i.d.=.".". .t.h.e.m.e.=.".t.o.o.l._.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360searchlite\360searchlite_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):149703
                                                                                                                                                                                                                          Entropy (8bit):4.549863563857598
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:Bq5EZuF+YiS8/qy4ppszVNbpwaLLU/gDzEJhj8HKwtI8yriY:xZuwYz8//RLLegs8HKw+
                                                                                                                                                                                                                          MD5:63C5291258FF6E9EBAB439096BD20936
                                                                                                                                                                                                                          SHA1:2DBAC59459BEEED1F8E409A628F04B92ADF57124
                                                                                                                                                                                                                          SHA-256:D83D1BF6AA9A21B4C57973548450B3B2DA43BDBCB2E1AF04E3AEABDF9D3F5F92
                                                                                                                                                                                                                          SHA-512:A1823ADD3DA1A516C56B5A4AF54193E46D18DEA47201CD3ED0DB7AAB91C03EB872074DFEB90F65CBCE58BFD63EC94BF10F7504C3CD3EBA9021D0FA69FCCA4542
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........E.1Mc]...2...2......DesktopSearch.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>.......<.r.e.s.o.u.r.c.e.s.>.........<.i.m.a.g.e.s.>...........<.I.D.I._.S.E.A.R.C.H._.B.U.T.T.O.N. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.s.e.a.r.c.h._.b.u.t.t.o.n...p.n.g."./.>...........<.I.D.I._.W.N.D._.C.L.O.S.E. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.c.l.o.s.e...p.n.g."./.>...........<.I.D.I._.S.O.R.T._.U.P. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.u.p...p.n.g."./.>...........<.I.D.I._.S.O.R.T._.D.O.W.N. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.d.o.w.n...p.n.g."./.>...........<.I.D.I._.W.A.I.T. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.w.a.i.t...p.n.g."./.>...........<.I.D.I._.S.C.R.O.L.L.B.A.R._.H.O.R._.T.H.U.M.B. .p.a.t.h.=."...\.3.6.0.s.e.a.r.c.h.l.i.t.e.\.I.m.a.g.e.s.\.t.h.u.m.b.1...p.n.g.".>.............<.i.m.a.g.e._.p.a.r.t.s.>............

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360skinview\360skinview_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1279387
                                                                                                                                                                                                                          Entropy (8bit):7.732116899914278
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:BX5oq6zp+q5eiva282MmXplanltCRfk2mlhJxRelc:BXmqqD5Q2planlDldac
                                                                                                                                                                                                                          MD5:44B6F370421A80C079FD2EF6C4A73BD9
                                                                                                                                                                                                                          SHA1:021927220427A93A3EE5D8D97216745C915272A6
                                                                                                                                                                                                                          SHA-256:E21893EB3B4E532586581AC60DA32871E271BDBF5251C22756BE1EF614BEA06E
                                                                                                                                                                                                                          SHA-512:9EB72F9F5AA0BB8AF1C4E9C581F8BB8DC57FD08789C004441BB6E4F32B6B6BD78D28096B15A2499EE48B2798D51231E245E59A4F17B79958B3626CE90A0C4FD5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........)].J................DPI_240_image/PK........)].J.nw~............DPI_240_image/aizai.png.PNG........IHDR...,...,.....y}.u....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:b70847d7-c88a-4e08-a710-5754639f0658" xmpMM:DocumentID="xmp.did:158A4B8FC26911E5ABD6EE04C0598C1A" xmpMM:InstanceID="xmp.iid:158A4B8EC26911E5ABD6EE04C0598C1A" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d0fa651f-6f13-4fd6-90b0-12d4bd634551" stRef:documentID="adobe:docid:photoshop:3c02a8a1-0ad0-1179-b7ae-b

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\360wdui\360wdui_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):909633
                                                                                                                                                                                                                          Entropy (8bit):4.946532397883922
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:B9nihWY6znslVoSx7EI+yB4XHElRMgwH0WviUzx:3KWY6zslWk7EI+yBsHEW/
                                                                                                                                                                                                                          MD5:3540F265457A93151587AC2D82BB56E2
                                                                                                                                                                                                                          SHA1:FF102CCCDA667821507A8419CB66BBECA271A5B7
                                                                                                                                                                                                                          SHA-256:1A3895D0A4D23981F0EA898D2876AA0C204D7E61DE65698C63A50DB583526873
                                                                                                                                                                                                                          SHA-512:FFFF45A59E595FE2AD3AAC48FCF84C6BC9EE21BA03D028EC2408CF30FBFFB3C6395C3A00C1863FC0FCA3A43EE7576B74ECADF2CD12C3AD2158F42E6941BC1E4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........S,R..3.............360wd.uiproj - ......lnkL..................F.... ...Ev.....f.q.....!.nZ............................g....P.O. .:i.....+00.../D:\...................`.1...../QH\..Repository..F....../Q.\/QH\..............................R.e.p.o.s.i.t.o.r.y.....x.1.....1Q.Y..360TotalSecurityUI..V......1Q.Y1Q.Y....^......................^'.3.6.0.T.o.t.a.l.S.e.c.u.r.i.t.y.U.I...".P.1.....1Q.Y..trunk.<......1Q.Y1Q.Y...._.....................W...t.r.u.n.k.....h.1......Q....RuntimeSiteUI.L......1Q.Y,RC.....#.....................3...R.u.n.t.i.m.e.S.i.t.e.U.I.....H.1.....1Q.Y..TS..6......1Q.Y,RC.....$......................{|.T.S.....P.1.....1Q.Y..newui.<......1Q.Y,RC.....%......................T|.n.e.w.u.i.....T.1.....1Q.Y..themes..>......1Q.Y,RC.....&......................T|.t.h.e.m.e.s.....V.1.....+R.>..default.@......1Q.Y,RC.....'.........................d.e.f.a.u.l.t.....f.2.....,RS. .360wd.uiproj..J......,R..,RS............................QV.3.6.0.w.d...u.i.p.r.o.j.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\ADMgr\pwlog_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75774
                                                                                                                                                                                                                          Entropy (8bit):4.070622467610207
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:l/LXjbTzqRewXJxmIQT1RxR6bstfAq3+Huad9LR:SJsrR6Atf3+Oml
                                                                                                                                                                                                                          MD5:F481BBE5E0CBA464A9E7ECDED41DB45A
                                                                                                                                                                                                                          SHA1:0D67DC16405CFB2C194AFC3FC627260BDEF2C1BF
                                                                                                                                                                                                                          SHA-256:74B017897A5F4D6D1DC1548B36926669EB964CEA975A22FC4B9F26F477809E0D
                                                                                                                                                                                                                          SHA-512:0FA5F801C4CADDDB2BBC4DD33313EBBF3816EAF40E3C2440FEC5090420E6CB0A07F3FAD4A9123CDAE4A115C5AE112F1E6F171137547741281BF2291928BC7273
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK...........M................DPI_240_image/PK.........VmM...|........'...DPI_240_image/AD-Blocker_ad_date_bg.png.PNG........IHDR.......<.....O]......tEXtSoftware.Adobe ImageReadyq.e<...xiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a483c67d-c57e-488b-94f9-03b1d4b98b92" xmpMM:DocumentID="xmp.did:0D5D7882CF9211E8BE8B9321B2472D3A" xmpMM:InstanceID="xmp.iid:0D5D7881CF9211E8BE8B9321B2472D3A" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02d8ddfa-d27c-4d18-bc8e-2708d10ac9c7" stRef:documentID="xmp.did:a483c67d-c57e-488b-94f9

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\Account\account_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2034795
                                                                                                                                                                                                                          Entropy (8bit):5.90942967074806
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:F/iLR8kw93fwjeuK12Fj1rwQPAXEGhdJ7:diekwVww1+yv17
                                                                                                                                                                                                                          MD5:52A39F79FB6770B52A5A2AC00884F613
                                                                                                                                                                                                                          SHA1:E50B572DB4884AA7BFF8E2108F2B09A6827555E3
                                                                                                                                                                                                                          SHA-256:7984A252C1062B102AD792A0EEC8A82D0491D1474772D254DBC8F681D428C68B
                                                                                                                                                                                                                          SHA-512:F8BDD89437366852615D1A2C509CA9DD9AF19F504F8C746C3AF425EECBAE9FDA404237F596916C4197F5571C34BD86BD761D27BA03A2F1A08D1CAFB308E30BFB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........p.aTO...............close_button.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>..... . . . .<.w.i.n.d.o.w. .R.e.s.o.u.c.e._.t.y.p.e.=.".". .a.n.i.m.a.t.i.o.n._.s.e.t.t.i.n.g.=.".". .b.o.u.n.d.=.".0.,.0.,.4.0.,.3.6.". .i.d.=.".0.". .s.c.r.i.p.t._.e.n.g.i.n.e.=.".J.S.c.r.i.p.t.". .s.c.r.i.p.t._.p.a.t.h.=.".". .s.t.y.l.e.=.".0.x.9.6.0.2.c.0.0.0.". .s.t.y.l.e._.e.x.=.".0.". .t.h.e.m.e.=.".w.i.n.d.o.w._.n.o.s.h.a.d.o.w.". .t.i.t.l.e.=.".".>..... . . . . . . . .<.p.a.n.e.l. .a.n.c.h.o.r.=.".0.". .b.o.u.n.d.=.".0.,.0.,.4.0.,.3.6.". .c.a.t.e.g.o.r.y.=.".{.A.C.E.9.4.4.1.1.-.E.3.F.B.-.4.4.C.8.-.B.D.2.C.-.F.E.3.3.0.3.C.C.E.B.3.B.}.". .c.o.n.t.r.o.l._.s.t.y.l.e.=.".0.x.0.". .i.d.=.".1.0.0.0.0.". .i.i.d.=.".{.E.D.5.A.6.2.5.2.-.F.4.4.9.-.4.5.E.9.-.8.2.5.E.-.C.2.7.E.9.8.A.2.6.3.5.9.}.". .i.m.a.g.e.=.".". .m.a.r.g.i.n.=.".0.,.0.,.0.,.0.". .s.h.o.r.t.c.u.t.=.".0.". .s.t.y.l.e.=.".0.x.1.8.0.0.0.0.2.0.". .t.a.b._.i.d.=.".0.". .t.h.e.m.e.=.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\BrowserPro\BrowserPro_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173091
                                                                                                                                                                                                                          Entropy (8bit):6.015176482540413
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:2JOgEgJEGLP7S822AtDaQMUEzSxFEqWuI1Ihc6V4KDERATR:iO821tbMUEzSxFEqWz1Ihl4KDEG
                                                                                                                                                                                                                          MD5:56D9329B8390D72A144E7377818F8152
                                                                                                                                                                                                                          SHA1:0F97AEF9FCEA7D258A324524B6C8E931C62AA6A9
                                                                                                                                                                                                                          SHA-256:C5D5F9E786399DC386F025032753F7FA762245852017B4B467D7ECF4FB6A3EF8
                                                                                                                                                                                                                          SHA-512:C0694996759AD0D44695A1339EF32B9868028B795E09DDD158F78784E87031914B4ED854A2D64FF96ED4C8D5C140BED36AF16AA7256E1354EC565191C24CFAD3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........U.KW..5............browserpro.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>..... . . . .<.w.i.n.d.o.w. .R.e.s.o.u.c.e._.t.y.p.e.=.".". .a.n.i.m.a.t.i.o.n._.s.e.t.t.i.n.g.=.".". .b.o.u.n.d.=.".0.,.0.,.6.9.0.,.4.7.0.". .i.d.=.".0.". .s.t.y.l.e.=.".0.x.9.6.0.2.c.0.0.0.". .s.t.y.l.e._.e.x.=.".0.". .t.h.e.m.e.=.".w.i.n.d.o.w._.c.l.e.a.n.p.l.u.s.". .t.i.t.l.e.=.".".>..... . . . . . . . .<.p.a.n.e.l. .a.n.c.h.o.r.=.".0.". .b.o.u.n.d.=.".0.,.0.,.6.9.0.,.4.7.0.". .c.a.t.e.g.o.r.y.=.".{.A.C.E.9.4.4.1.1.-.E.3.F.B.-.4.4.C.8.-.B.D.2.C.-.F.E.3.3.0.3.C.C.E.B.3.B.}.". .c.o.n.t.r.o.l._.s.t.y.l.e.=.".0.x.0.". .i.d.=.".1.0.0.0.0.". .i.i.d.=.".{.E.D.5.A.6.2.5.2.-.F.4.4.9.-.4.5.E.9.-.8.2.5.E.-.C.2.7.E.9.8.A.2.6.3.5.9.}.". .i.m.a.g.e.=.".". .m.a.r.g.i.n.=.".0.,.0.,.0.,.0.". .s.h.o.r.t.c.u.t.=.".0.". .s.t.y.l.e.=.".0.x.1.8.0.0.0.0.2.0.". .t.a.b._.i.d.=.".". .t.h.e.m.e.=.".I.n.t.e.r.n.a.t.i.o.n.S.a.f.e._.d.e.f.a.u.l.t.". .t.i.p.=.".".>..... .

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\DailyNews\DailyNews_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):130909
                                                                                                                                                                                                                          Entropy (8bit):5.547765943651518
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:U0m8+zE/h+bo7S9J5egE4DejATs+lKIHiz+ec6P:U0m8+zTo4lE44A4AiqV6P
                                                                                                                                                                                                                          MD5:A1BEE30E519CFFCE257F6E721B38B2F3
                                                                                                                                                                                                                          SHA1:139802ADDD9CF3C03F3E480AC4EE77AC724599CA
                                                                                                                                                                                                                          SHA-256:65734FF4192623951E51FE04837DF98DEE93E862B7B4B644DDBFFEB9141E05DA
                                                                                                                                                                                                                          SHA-512:06F45B6CDE5FE00747416AF1507A39E9644BC6945AC07317223C0F16E3E4C148BC951FE7A4264018E10173EFC9C026B8EA62E6FCC067B6B18D615A6D5789F09E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........`DX.a.b=:..=:......DailyNews.zipPK.........`DX.p..)..........setting_dlg.xml.]i.sS.>(R"..!....n[..0|:..{1...:m....t0.%.;....'.?..%$. .K$. ..X...=.n]..s[.&....<..g....>&.sEE..8[.E],.....8@.$"boa.:(.....V..*r.h...B.a....M.Fb..U.RB<.7(..;...".9..F..p/..\..,..B...3(...J...1..+.#.t%.C.-".:..._.K^...|.....q..:.a.KUV.-....5.T..........S....g.p,..%...v..TF...Z.{f.9..S.Z.G.ENEN....I......E...]LL.q........rJ.5E..Y8R..a1...3......gZ[...#.v-..*.$..G...8.<.K3J...$...:.W..I..K.=.2.qw.....U)...82tF.#.Q.`.sK...4|..i.#-..KT..k.6.d...9......"(..~Q.5Y.a.}+...]F...K..`ha..qq.#Zi..G...m.......m.F....w..d...)s.q..z.X....vBP.-...Q.E|..!.D.)..A.1.p./...5.0.x.*4.R.K.g...!../.I.jY....{O..,.T>.68.4........$DpgQ.uF..$c.;.k...aS....."...C..../.......p..........3p..').D.[9ee.dX.7...<}.mt;...(3.^"N.%.I2....F.b.k.....n.R-....yB,..m]...S>9.\...!...3...\.$o.........q..?...R.........K.{.pN.2.........1J.#\1;DP.)...>.').K.o....I....b+....i.iG.2..8.@..c.b

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\DataShield\DataShield_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175948
                                                                                                                                                                                                                          Entropy (8bit):4.9337421843258555
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:kAas0cWrVAaByXritfU7eQUjg1OPlkklA:YfU
                                                                                                                                                                                                                          MD5:94CB996BCE563E7AC19BEF13775CEB3A
                                                                                                                                                                                                                          SHA1:CD58CA30C13A819D23702114FA7C7046DDE9C5F8
                                                                                                                                                                                                                          SHA-256:886DF41A3CC0C16DACF4A59473913059E0BB5A3D3B0F5983941C3B5969CB6A20
                                                                                                                                                                                                                          SHA-512:D89566528D7B3D2495F5EF68E53CE595291F6DC6F342DAE6871038F4188B19351394089EE2855F65D4B27D58E4FD7DD0D44A49ABFAE2C291A6593C388E11A33F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........A..T................image/PK...........T.._$,..$,......image/bk_empty.png.PNG........IHDR...............g-....sRGB.........sBIT....|.d... .IDATx..}k.d.y..V...wf....c..E.dI.r...0..qb....I.8..........Rnp.. ;.l+.EY".k:....%^v.3=..s..|..9}..=;3...f..N.....Ru...l....l....l....l....l..U.=..l.^<x..Y......g..$...X?pE..k....w....!....7O........~@R|m.d...........gK..,.L......y..R.7..|..3;_[u...^r..xU...R.7...8o.9.....^R<).9...b....|...g.$...5...v6...`....}.B.g.l.x.....Y..*TxC.K...~.......3.......,...2_..|...gY...ZS..~..Dg...h......;[...@.wz#...k..^cb.Ua..W..|....2..q..$n...7.N..o...n.x..N...#...~..*.\gv.uV......?..~....:...?WMv].UbC.K.!................Z..W..........w{S..XfGd..w.....I.......[.....7.x....t.b.S.bC.K.u..[...H......*..!.%.gv..?L.D...*.xC.K.e}...d..c.._b<x..YV..s=..B....^....._>..........6O.m...$....9.uE...k_.1.w...9n.xE....).;.U}G..(.r.Z.{.K..o.>....6.`..68/l........).\..^...9....s..!..........4.{E...vg..>...6d......w_o........%.:......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\DesktopPlus\DesktopPlus_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2752284
                                                                                                                                                                                                                          Entropy (8bit):7.507895297757676
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:wb/ocvV89OxsR3Xb3HUnC/ocvV89OxsR3Xb3HUnIl3:wbQc9nxM3r30CQc9nxM3r30Ip
                                                                                                                                                                                                                          MD5:E20B0D486CAA3911CE0C425B5C8746F5
                                                                                                                                                                                                                          SHA1:59C181D2DFACC07FEE7001ADBE0F6301DB18F553
                                                                                                                                                                                                                          SHA-256:DDCAD9AE427569F62DA3215069239578F34EFDA606C0A175A1801A91D92B987A
                                                                                                                                                                                                                          SHA-512:D992B1D908A8EC4140C7430E1F0D82DDCB53AE21113DF797E19AFA7F515C9C074385997471A6D0A0293DB916592E705BC7C56A89E557F3D87A5B4425F5588941
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........]/X................DPI_240_image/PK..........aTi...m...m.......DPI_240_image/Blue.png.PNG........IHDR...(...(...... H_...EPLTE..."..".."..".."..".."..".."..".."..".."..".."..K.."..)..8..B..@..4.........tRNS...L..X...W..f.......IDAT8..... .E.P.["...j..z.e..g.9.s....*3..4.........{....{..K.^.aa..y.%..6..zF..V).go.b.'...S^.......3..Di.rb..p...[V...`.s....#s.#..pH.$Z.X..6L....x.....|.....`}a...UXW....g:hs..H.d-..H.Q...Q+.u.?.....IEND.B`.PK..........aTg...............DPI_240_image/check_clr.png.PNG........IHDR...(...(........m....sRGB.........IDATX..?k.A.......Nr. V.E>A4`ea...|...]l......J.."..T......! ..{nw.u...........}.}.3.3s..ZQ.k....W......Z..Y.}.DR..|W~ .k.....R...s..|^..\...T.m..c.un.C*8...?.TF.<....%.S.Y.... u!.%.......E..X.1.TQ@...}nV......%....{...V.?.U)Fz..$.F.........Ll......(...{.O.[.......G...&..x./.m|d..w..\.3.Y..#..w.....{...^.J7BA.LI..}?6.....w.M...%.&.In\6.~.;.:.L6..48.{.j/.g..*./.X.8...>~e..E..gAF.....E.5ttF.i...HYp....}.... #..x. +

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\DeviceMgr\DeviceMgr_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1134993
                                                                                                                                                                                                                          Entropy (8bit):7.283003404782665
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:h7oSZpMjiPkv35PZHG33ftz7RKiCzylr3fmVe/Mtkfp2n8eVbEHwiOr1:h1kiPkv5xm33l3pCzylr3f0e/yK3fC
                                                                                                                                                                                                                          MD5:51AF7BB28A578AA8CBFCE690A3FBCB9F
                                                                                                                                                                                                                          SHA1:4A135FCD962B01A7774AECDF678ECAC63BE85482
                                                                                                                                                                                                                          SHA-256:4B9EC6AB057E01A7CCE9613620F7C5C0B8BC1947FEE913883878D97FEA1059CA
                                                                                                                                                                                                                          SHA-512:915DCE4147F974AC2669C03D2AA385398C5E3F5992FE10DB7080CC574FAE46297AE96C02647F7602047303D9F679902444EE99B940F89255D3B6C2FD2C04B9DD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........0].J................DPI_240_image/PK........0].J............#...DPI_240_image/360connect_camera.png.PNG........IHDR.......d.......fw....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:f631376f-639b-40c9-88e8-e0b0d3d94a71" xmpMM:DocumentID="xmp.did:263C722E925811E6A336CE5B40A96D6F" xmpMM:InstanceID="xmp.iid:263C722D925811E6A336CE5B40A96D6F" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9871d545-f454-4c17-97c8-9ffe506d9844" stRef:documentID="adobe:docid:photoshop:ce518d42-b9

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\DriverUpdater\driverupdater_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):552915
                                                                                                                                                                                                                          Entropy (8bit):5.461201712818633
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:XWGSPejGdCa1Vnqg02YIbpxIBgUdjrg0R+nLqo+jNVrNAwdEzu9efOVmS4VvQ7YZ:9C1Vnp5YIbpxs/j5gLRU+B
                                                                                                                                                                                                                          MD5:222187CFD4F4D6939D1A87F54AD4064B
                                                                                                                                                                                                                          SHA1:CDEDBC3EDA7B270564F37865BB7534A55A1E98F2
                                                                                                                                                                                                                          SHA-256:C142C911297C24522E6AB0310F25BF7AA78F1B1C361EC43FA4E3803D8B0E9A66
                                                                                                                                                                                                                          SHA-512:117E6FA82AE2951A1054ECFD3F9D2D1439681FDF798B2E14BF7B3203CBA085B5909CB6DB997DCD7806893DC879886B7A0F580C79F703505D97FCF731C027C401
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK..........Q................DPI_240_image/PK........I..Q.^-.v...v...-...DPI_240_image/com_control_drop_down_arrow.png.PNG........IHDR.......<......k......tEXtSoftware.Adobe ImageReadyq.e<...ziTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:79556c47-b40a-4c76-b7cb-2e8a14ae6778" xmpMM:DocumentID="xmp.did:4EB18E72B1DB11E7A029B2EDC3829A52" xmpMM:InstanceID="xmp.iid:4EB18E71B1DB11E7A029B2EDC3829A52" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2431fdd8-0eef-4631-bae1-db99a74a98a8" stRef:documentID="xmp.did:79556c47-b40a-4

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\DuplicateFile\DuplicateFile_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1197744
                                                                                                                                                                                                                          Entropy (8bit):6.971781079094911
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:DRKF1KdzDGSsRUV5gFdJo2gcRmPq8gP402f8ec8:DVJDGSjPWwploC80
                                                                                                                                                                                                                          MD5:00C204F1D97D3B1B43FF782666F29EFD
                                                                                                                                                                                                                          SHA1:C68DCDA9205220609A29840412E36710B7375A27
                                                                                                                                                                                                                          SHA-256:5C1BDD99ADC37F11B4CAF7C761D423273A74D577CC93ABFA054E36B58BA80547
                                                                                                                                                                                                                          SHA-512:CBE2A864A295D8F604D6C35B76A347C00C30DAB995A96998C246E7AB8F1F6C6DA35591CFD2AB916633F4FEEDB910E202B9FF76FA84142616A9C220FA8E4F9054
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........}.W..HDM...M.......clean.json{"v":"5.6.9","fr":25,"ip":0,"op":100,"w":950,"h":940,"nm":"action03","ddd":0,"assets":[{"id":"image_0","w":324,"h":324,"u":"","p":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAUQAAAFECAYAAABf6kfGAAAACXBIWXMAAAABAAAAAQBPJcTWAAAAJHpUWHRDcmVhdG9yAAAImXNMyU9KVXBMK0ktUnBNS0tNLikGAEF6Bs5qehXFAAAgAElEQVR4nOy9faxsS1re97xV3b33mcOcYS7cYS6MwZBhgCviODjCAcWWhaMEK7H/iA3IliwcK3GQiZREQSEfUvDElmwLJVIsW4lJhCzbcqJY2CKJJeNICA0ocWQH7MhcEIFx4hm4MHfmgs/cPWfv7q5680fVW/VWrVqrV/f+7O56rs7t1etjf/Re/evn/agqoKurq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urqyV67B+g64TF/DTvLyJ+7B+h62nqad6wXU9bTxV0d60OzrPTedzYXYfrXOA3Vx2SJ61+s3eVejAAfvyev88PPAy4OiBPSh2IXfcEwfsG3m11D8DscDx6PfGbtutedScgvC/wvbnj6751T/C5A1B2MB6tOhDPUbcC4W0AuAty96XbwPMWgOxgPDp1IJ6TDgbhvhC8S/C9VX2tN+8

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\HomeRouterMgr\HomeRouterMgr_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):468317
                                                                                                                                                                                                                          Entropy (8bit):5.2789673847403025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:H57HKfM0f2DvKSe4RKCugWbvvvvvvvvvvvvvvvyvvvvvvvvvvvvvvvvvvvvvvvvB:Z7B48KSe4UprZ7Srf
                                                                                                                                                                                                                          MD5:1AFA2B81C81D7048938C38F45816CD73
                                                                                                                                                                                                                          SHA1:F68A4B19D3C075988010F952D34DC58DC9D6B257
                                                                                                                                                                                                                          SHA-256:4DD579BAB8CBED8CCDF320E617AD883334E3736F5B2134B79834D9FE7A61DF50
                                                                                                                                                                                                                          SHA-512:8C0246075A2EEF3F7F235C6D175AD53FE84A6648393D9DDAEEE73A6D5764D6F6FB5E9A5647D0B6757C574D694987E86CE41DED908004B13BA3F570E602F0C0E2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........,].JM...............DeviceItemList.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>..... . . . .<.w.i.n.d.o.w. .R.e.s.o.u.c.e._.t.y.p.e.=.".". .a.n.i.m.a.t.i.o.n._.s.e.t.t.i.n.g.=.".". .b.o.u.n.d.=.".0.,.1.6.0.,.6.9.6.,.4.5.0.". .s.t.y.l.e.=.".0.x.2.c.7.0.0.0.0.". .s.t.y.l.e._.e.x.=.".0.x.0.". .t.h.e.m.e.=.".d.e.f.a.u.l.t.". .t.i.t.l.e.=.".".>..... . . . . . . . .<.p.a.n.e.l. .a.n.c.h.o.r.=.".5.". .b.o.u.n.d.=.".0.,.1.6.0.,.6.9.6.,.2.1.6.". .c.a.t.e.g.o.r.y.=.".{.A.C.E.9.4.4.1.1.-.E.3.F.B.-.4.4.C.8.-.B.D.2.C.-.F.E.3.3.0.3.C.C.E.B.3.B.}.". .c.o.n.t.r.o.l._.s.t.y.l.e.=.".0.x.0.". .f.i.r.s.t._.o.f.f.s.e.t._.i.t.e.m.=.".0.". .i.d.=.".1.0.0.0.". .i.g.n.o.r._.m.e._.o.n._.d.r.o.p.=.".0.". .i.i.d.=.".{.E.D.5.A.6.2.5.2.-.F.4.4.9.-.4.5.E.9.-.8.2.5.E.-.C.2.7.E.9.8.A.2.6.3.5.9.}.". .i.m.a.g.e.=.".". .i.t.e.m._.s.p.a.c.i.n.g.=.".0.,.0.". .m.a.r.g.i.n.=.".0.,.0.,.0.,.0.". .o.f.f.s.e.t._.b.o.t.t.o.m.=.".0.". .o.f.f.s.e.t._.r.i.g.h.t.=.".

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\InstantSetup\InstantSetup_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):368000
                                                                                                                                                                                                                          Entropy (8bit):4.872375147404655
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:hQ9WdPdALdGuGVhedqoCVUD20H64RBZawEIcYngysMDMqoloSXvR7RmRFsRRTuSJ:WesdDqu+gAgZmQFZg/7msd
                                                                                                                                                                                                                          MD5:846E366126E938306B25E5CF307888CA
                                                                                                                                                                                                                          SHA1:4F7F9208E4C06A8E3E368FC9B7CF9A96ED4DA82A
                                                                                                                                                                                                                          SHA-256:11B9FAF90F47A50BEADF1D8BE98475EAACE91BA4997C13CC3159D8E2C165A86D
                                                                                                                                                                                                                          SHA-512:4E4AB9CAA98A8A0BC08A54464A03586869B9E3D0C42C2FFD70083E37A1EAF4D8FE142FAC4F81AA1091DDFE82B496D876EB0282EE2985B1E42E478F4355D20655
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........U.Kj%.9.-...-......continuetip.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>..... . . . .<.w.i.n.d.o.w. .R.e.s.o.u.c.e._.t.y.p.e.=.".". .a.n.i.m.a.t.i.o.n._.s.e.t.t.i.n.g.=.".". .b.o.u.n.d.=.".0.,.0.,.3.6.4.,.1.8.0.". .i.d.=.".0.". .s.c.r.i.p.t._.e.n.g.i.n.e.=.".J.S.c.r.i.p.t.". .s.c.r.i.p.t._.p.a.t.h.=.".". .s.t.y.l.e.=.".0.x.9.6.0.2.c.0.0.0.". .s.t.y.l.e._.e.x.=.".0.". .t.h.e.m.e.=.".w.i.n.d.o.w._.I.n.t.e.r.n.a.t.i.o.n.S.a.f.e._.w.d._.p.o.p.". .t.i.t.l.e.=.".".>..... . . . . . . . .<.p.a.n.e.l. .a.n.c.h.o.r.=.".0.". .b.o.u.n.d.=.".0.,.0.,.3.6.4.,.1.8.0.". .c.a.t.e.g.o.r.y.=.".{.A.C.E.9.4.4.1.1.-.E.3.F.B.-.4.4.C.8.-.B.D.2.C.-.F.E.3.3.0.3.C.C.E.B.3.B.}.". .c.o.n.t.r.o.l._.s.t.y.l.e.=.".0.x.0.". .i.d.=.".4.0.0.0.0.". .i.i.d.=.".{.E.D.5.A.6.2.5.2.-.F.4.4.9.-.4.5.E.9.-.8.2.5.E.-.C.2.7.E.9.8.A.2.6.3.5.9.}.". .i.m.a.g.e.=.".I.D.I._.D.I.A.L.O.G.B.K._.R.E.D.". .m.a.r.g.i.n.=.".0.,.0.,.0.,.0.". .s.h.o.r.t.c.u.t.=.".0.". .s.t.y

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\MedalWall\MedalWall_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):655091
                                                                                                                                                                                                                          Entropy (8bit):7.3834009594064876
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:oe8Gs0qeXBgs1pjRxSmgiWGh6LYoQVsEmdInKaId7EmdS9cGK:32WxLcmgyMMoQVsndInKznd3
                                                                                                                                                                                                                          MD5:CB68BCD6ABA9667C8CA6A874461C2925
                                                                                                                                                                                                                          SHA1:83352A51F44EE53839094942ED926DC0EA449EFB
                                                                                                                                                                                                                          SHA-256:6F95CB1C81CADC16E4310A5C713137435FF5346EA7A33C9AC47AB85FBA332837
                                                                                                                                                                                                                          SHA-512:2500ECC61D7B5EB837A8D00FF8FBD31D149A3A12A599B5AFA180176DF5968D330B5CBAF724567941DB5AC0759DA6CE8262DD74B0D2A0076346C0C8B7094F4C4F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........Iq.K................DPI_240_image/PK........Iq.Kp?.'...'...*...DPI_240_image/com_madal_collect_button.png.PNG........IHDR.......P.....-:......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)" xmpMM:InstanceID="xmp.iid:7B1333FDD32B11E78420CF1CAC3825C8" xmpMM:DocumentID="xmp.did:7B1333FED32B11E78420CF1CAC3825C8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7B1333FBD32B11E78420CF1CAC3825C8" stRef:documentID="xmp.did:7B1333FCD32B11E78420CF1CAC3825C8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\PopWndTracker\pw_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):214084
                                                                                                                                                                                                                          Entropy (8bit):4.8350474953988165
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:92a71pDlFw/QKDyCHbJxvlIDycNZgpnYc9+lxT8Aj6BKokgRO6w04n/:wsGye7IDycgtt9cxT8/Kokgd4
                                                                                                                                                                                                                          MD5:33927DA4CD611DE0D41D9106EC83EF39
                                                                                                                                                                                                                          SHA1:A7ADAC31651AF6A82853E04A75EFD65DE1B3FB95
                                                                                                                                                                                                                          SHA-256:9B697DFB647C51C53B24EDD5551081C512623B2C16485B6B185074BB8BAF0D42
                                                                                                                                                                                                                          SHA-512:BEB883D2FB5C2DFFD8A0A3229EFB8BE0493C01B3BBD5CEB1E35C4614770FDCFCF9C3B800BE9093DEE1B0262CAB63527CA58A2B919E6065AF903A5EE054D69AC5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........p.Mr.i.............AdHatNew.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>.......<.r.e.s.o.u.r.c.e.s.>.........<.i.m.a.g.e.s./.>.........<.s.t.r.i.n.g.s.>...........<.I.D.S._.D.E.S.C.>.............<.e.n.>.A.D. .i.s. .d.e.t.e.c.t.e.d.<./.e.n.>.............<.z.h.-.C.N.>..hKm0R.^JT<./.z.h.-.C.N.>.............<.i.t.>.L.'.a.n.n.u.n.c.i.o. .v.i.e.n.e. .r.i.l.e.v.a.t.o.<./.i.t.>.............<.z.h.-.T.W.>..j,n0R.^JT<./.z.h.-.T.W.>.............<.v.i.>.Q.u...n.g. .c...o. .......c. .p.h...t. .h.i...n.<./.v.i.>.............<.p.t.>.A.n...n.c.i.o. .d.e.t.e.t.a.d.o.<./.p.t.>.............<.f.r.>.P.u.b.l.i.c.i.t... .d...t.e.c.t...e.<./.f.r.>.............<.d.e.>.W.e.r.b.u.n.g. .e.r.k.a.n.n.t.<./.d.e.>.............<.p.l.>.W.y.k.r.y.t.o. .r.e.k.l.a.m...<./.p.l.>.............<.r.u.>. .5.:.;.0.<.0. .>.1.=.0.@.C.6.5.=.0.<./.r.u.>.............<.j.a.>..^JTL0.i.QU0.0~0W0_0<./.j.a.>.............<.e.s.>.A.n.u.n.c.i.o. .d.e.t.e.c.t.a.d.o.<./.e.s.>.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\PromoUtil\PromoUtil_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):149928
                                                                                                                                                                                                                          Entropy (8bit):5.442184495003661
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:DYkyzlCUxucpY7jMYut0+Xb87GYB9GyUA+9dONd1W2ZhgL/NnVy:DYky/Ujxu1Xb8NwhA++Nd1rW/N4
                                                                                                                                                                                                                          MD5:FCFEA9F3B9EC1DB49475C92D4392FA01
                                                                                                                                                                                                                          SHA1:9225DC2C2C91D14A6E31AF581E781F2C9797C5C5
                                                                                                                                                                                                                          SHA-256:0203B48BB25929B279C14D9E18A3C556138B75B98C34B0A7F427F67922956D70
                                                                                                                                                                                                                          SHA-512:25FCBFF9D444923B18BBD8249C2DE4FAD7BDDC251F170E220C37BD47C3B2C54FC70F17FD877C0591C7182BB732CE3EAE81B297C90DCB0C44549AB85D18E15B68
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........6.<R..]. ... .......ads_frame.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>..... . . . .<.w.i.n.d.o.w. .R.e.s.o.u.c.e._.t.y.p.e.=.".". .a.n.i.m.a.t.i.o.n._.s.e.t.t.i.n.g.=.".". .b.o.u.n.d.=.".0.,.0.,.3.0.0.,.2.7.6.". .i.d.=.".0.". .s.c.r.i.p.t._.e.n.g.i.n.e.=.".J.S.c.r.i.p.t.". .s.c.r.i.p.t._.p.a.t.h.=.".". .s.t.y.l.e.=.".0.x.9.6.0.2.c.0.0.0.". .s.t.y.l.e._.e.x.=.".0.". .t.h.e.m.e.=.".w.i.n.d.o.w._.n.o.s.h.a.d.o.w.". .t.i.t.l.e.=.".".>..... . . . . . . . .<.p.a.n.e.l. .a.n.c.h.o.r.=.".0.". .b.o.u.n.d.=.".0.,.0.,.3.0.0.,.2.7.6.". .c.a.t.e.g.o.r.y.=.".{.A.C.E.9.4.4.1.1.-.E.3.F.B.-.4.4.C.8.-.B.D.2.C.-.F.E.3.3.0.3.C.C.E.B.3.B.}.". .c.o.n.t.r.o.l._.s.t.y.l.e.=.".0.x.0.". .i.d.=.".1.0.0.0.". .i.i.d.=.".{.E.D.5.A.6.2.5.2.-.F.4.4.9.-.4.5.E.9.-.8.2.5.E.-.C.2.7.E.9.8.A.2.6.3.5.9.}.". .i.m.a.g.e.=.".". .m.a.r.g.i.n.=.".0.,.0.,.0.,.0.". .s.h.o.r.t.c.u.t.=.".0.". .s.t.y.l.e.=.".0.x.1.8.0.0.0.0.0.0.". .t.h.e.m.e.=.".p.m._.d.e.f.a.u.l

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\SysCleaner\SysCleaner_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):453399
                                                                                                                                                                                                                          Entropy (8bit):4.720076882520069
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:ndYwclvpmcANB2B635KYXakIVT6Xl8n1reB2EQs0g7rNRU8+6oGPJrkca5Q8sMs7:nwlBaB26Ky7rnNw1eUfwN
                                                                                                                                                                                                                          MD5:F5FD2CB95AAB5BD3F4107F8FF8451289
                                                                                                                                                                                                                          SHA1:C76DB0F220DD525FDD7AA11C3CA78886A65D8260
                                                                                                                                                                                                                          SHA-256:4AA696BA4959278367BD248F01A5E4929BC406271F0165059BED427E2588087B
                                                                                                                                                                                                                          SHA-512:B5D2FA5A26F8688B53AF105FFA861B5D42C59065E55521A5D6CC5CFC80C588656EAD7ED398B1E1E097B2D64CAC2965E0F37E38E52FBE74DC951E619900CBABB2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........IO................Image/PK.........Z.ND\.D.:...:......Image/360MoveData.ico......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%..........................................................................................................................................................................................................................2..'2..2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2..2..'............2..(2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2..(........2..2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2...2..........2...5...@...F...G...G...G...G...G...G...G...G..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\TraceClean\TraceClean_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):715322
                                                                                                                                                                                                                          Entropy (8bit):3.578213716799548
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:iQygCU/aXUjjYQ3ssBUuC9J9T6tj55JRdC6j0WcuUcDjjTXIDA8EIXKFNFqGeXwv:J5ck
                                                                                                                                                                                                                          MD5:CC05643D5AB2B8A926BDFA14920D6696
                                                                                                                                                                                                                          SHA1:774E2802FB1B5D9AB527D422DFEB6D5439F5C51B
                                                                                                                                                                                                                          SHA-256:E8C4109E099C90528248C061AC397CA829BF63009EE239C93953101BA0591671
                                                                                                                                                                                                                          SHA-512:B598E266BB1BBF100370F6641C8194935A8BC46E6A1325763BE1B71F18767E41A0309E27CD2B6D69D65F36F1973EC45BFAD3955A2E863D1CB28ECE65880E8A26
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........z.'Q................detailed_dlg.xml..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.c.o.n.f.i.g.>..... . . . .<.w.i.n.d.o.w. .R.e.s.o.u.c.e._.t.y.p.e.=.".". .a.n.i.m.a.t.i.o.n._.s.e.t.t.i.n.g.=.".s.h.o.w. .i.n.f.l.a.t.e._.l.i.n.e.a.r. .0.,.h.i.d.e. .i.n.f.l.a.t.e._.l.i.n.e.a.r. .1.5.0.". .b.o.u.n.d.=.".0.,.0.,.6.1.0.,.5.0.7.". .i.d.=.".0.". .s.c.r.i.p.t._.e.n.g.i.n.e.=.".J.S.c.r.i.p.t.". .s.c.r.i.p.t._.p.a.t.h.=.".". .s.t.y.l.e.=.".0.x.9.6.0.2.c.0.0.0.". .s.t.y.l.e._.e.x.=.".0.". .t.h.e.m.e.=.".w.i.n.d.o.w._.m.a.i.n.". .t.i.t.l.e.=.".".>..... . . . . . . . .<.p.a.n.e.l. .a.n.c.h.o.r.=.".1.5.". .b.o.u.n.d.=.".0.,.0.,.6.1.0.,.3.6.". .c.a.t.e.g.o.r.y.=.".{.A.C.E.9.4.4.1.1.-.E.3.F.B.-.4.4.C.8.-.B.D.2.C.-.F.E.3.3.0.3.C.C.E.B.3.B.}.". .c.o.n.t.r.o.l._.s.t.y.l.e.=.".0.x.0.". .i.d.=.".2.0.0.0.". .i.i.d.=.".{.E.D.5.A.6.2.5.2.-.F.4.4.9.-.4.5.E.9.-.8.2.5.E.-.C.2.7.E.9.8.A.2.6.3.5.9.}.". .i.m.a.g.e.=.".I.D.I._.D.I.A.L.O.G._.B.A.C.K.G.R.O.U.N.D.". .m.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\default_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1266766
                                                                                                                                                                                                                          Entropy (8bit):7.717853523116026
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:8tTbnF58Bz08JzntxZCBvlh1Ibre6cSJDvpwUBPFc9:8zkJzHZmIbr97NveUtFs
                                                                                                                                                                                                                          MD5:DBA070908030DEBE69FAE6E3C3EEC036
                                                                                                                                                                                                                          SHA1:BAE96347299D945BC691F1A4DA26961971EFF1FB
                                                                                                                                                                                                                          SHA-256:E12832C7A39F43D2F64C75DFF5FFF092E3511671361A5EFEB037AA3B101820C3
                                                                                                                                                                                                                          SHA-512:0349E93CD3E1F1D42E92B72578F13311A5ADE87EB3628A57670002DBE0D48BA30B617C7BB093306977D7B3D49CC8275F9FC0A89CF29890583440E9D2136A8961
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK.........[.X................Common/PK.........[.X................Common/Image/PK........W.HT........... ...Common/Image/bk_caption_logo.png.PNG........IHDR.............(-.S....PLTE.....F..F..@..F..F...U.&.....?...........F.....F...:..3.6.....F...".3z..x.!..;.....F..E..E........F..F..H.....F..............E........E........E(.5'.4..........................<..:d.&f.#.....................^..."tRNS....../......../..............F11.......IDAT..=.G..0.DE....`C0...r.;...W.#-4...z.VW.PRY...3.T...,.(....d)U.,.....P...."t.....3B....n..p.8t...b.)..J...?..hC7`q,8!.#.A.......a.{P[......*.N.so..t.Uz...'5..;j.&.........O...?....$.Y.....IEND.B`.PK........W.HT...0T...T..."...Common/Image/bk_caption_logo_2.png.PNG........IHDR.............(-.S...]PLTE.............................................................................................Q*......tRNS...'.....i........R.wk^FC+.........IDAT..e.Y..1.Di.gbfw..........]..$\3.i...4cu1..^.w."...gs=.3r!...1D.iaKnP.P....k.@.[.J...g...r.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\feedback\FeedBack_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):142517
                                                                                                                                                                                                                          Entropy (8bit):4.895555462818922
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:D7ySwoSzUSzsby8SzUSzswzy/k43waahJ2rwvb7QWq:D99a+
                                                                                                                                                                                                                          MD5:5A7DF04C5AE16702C6C2F005A7424E54
                                                                                                                                                                                                                          SHA1:98E9E79DD5432D161D7BA7AD29F92A27E9F316FE
                                                                                                                                                                                                                          SHA-256:07018715705D87C9C74EEAD2F293FC6386813998D8B6D71FD0C3A01D344A4998
                                                                                                                                                                                                                          SHA-512:A3B97E851384FB2BDD41F5636FE2124EA1A4ABCF9AD42D6F6CBB286A75D8A9DC4A66258831A531A511632D6930C2040D56BE88B52F55A1DE4D9907B0628C43B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........`.=P................DPI_240_images/PK........`.=P..k ............DPI_240_images/combo_bg.png.PNG........IHDR... ...<.............sRGB.........gAMA......a.....pHYs...%...%.IR$.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d7fe069f-5aca-46a8-9db0-684f0605a7f9" xmpMM:DocumentID="xmp.did:03CCF220C26411E5ABD6EE04C0598C1A" xmpMM:InstanceID="xmp.iid:C0F5626CC26211E5ABD6EE04C0598C1A" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:70a3bcdb-3745-4ab4-a9a3-bad87f2d3acd" stRef:docu

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\popwndtracker_theme.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):38508
                                                                                                                                                                                                                          Entropy (8bit):3.5971315522767973
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:BFGRIGR2vGVM3RIRqGDRmWcc+e1lwaQwz3IXbNrIZkGOXzgKiL1vvFA4Bg:BFGRIGRgGGBIsGDRmWcFaFMP
                                                                                                                                                                                                                          MD5:7746E992FCBDC5620C9544FF12602278
                                                                                                                                                                                                                          SHA1:BCAC211BC12BC14DA57AE6EBA4753AF573D7AF57
                                                                                                                                                                                                                          SHA-256:3AFBAE47A4FADE79C3A8D7CD5E0239ECA76FA4FE48EAD6B7AA98BBA67EE91BD8
                                                                                                                                                                                                                          SHA-512:1E6DFFC37C03571C8D4119459699911111AAF6054801B28E0DE27F9365C5A4576415E884E7709CA262EB7F721213633CCFEEE69453D7769ED6216C6A3628B744
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.t.h.e.m.e.s.>.......<.w.i.n.d.o.w.>.........<.D.e.t.a.i.l.e.d.P.a.g.e. .i.c.o.n._.p.o.i.n.t.=.".4.,.4.". .s.h.o.w._.i.c.o.n.=.".1.".>...........<.c.a.n.v.a.s. .n.o.r.m.a.l.=.".0.x.f.f.f.e.f.6.e.5.". .i.m.a.g.e.=.".../.i.m.a.g.e./.b.g._.d.e.t.a.i.l...p.n.g.". .f.i.l.l.=.".0."./.>...........<.b.o.r.d.e.r. .n.o.r.m.a.l.=.".0.x.f.f.0.0.0.0.0.0.". .w.i.d.t.h.=.".1.". .i.n.n.e.r.=.".0.x.c.d.c.d.c.d.c.d."./.>...........<.f.o.n.t. .f.a.c.e.=.".._o...". .c.o.l.o.r.=.".0.x.0.0.f.f.f.f.f.f.". .s.i.z.e.=.".9.". .b.o.l.d.=.".0.". .i.t.a.l.i.c.=.".0.". .u.n.d.e.r.l.i.n.e.=.".0."./.>...........<.s.h.a.d.o.w. .b.o.r.d.e.r.=.".1.1.,.7.,.1.1.,.1.5.". .i.m.a.g.e.=.".../.i.m.a.g.e./.w.i.n.d.o.w._.s.h.a.d.o.w...p.n.g."./.>...........<.c.a.p.t.i.o.n. .s.h.o.w.=.".0.". .h.e.i.g.h.t.=.".1.0.0.". .c.o.l.o.r.=.".0.x.f.f.f.f.f.f.f.f."./.>...........<.s.y.s.t.e.m._.b.u.t.t.o.n. .o.f.f.s.e.t._.p.o.s.=.".8.". .c.a.p.=.".2.". .t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\promoutil_theme.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11032
                                                                                                                                                                                                                          Entropy (8bit):3.5557163634828974
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:BAnI+W286rAXfM6MJMZMmMPM/Jym1XMlXMiM9MqMhMLurTArytOzMzRJz/eOlgPk:fXY68FTcyDfOXzgKiL1vvFt
                                                                                                                                                                                                                          MD5:BC55D5DBB5BEFB3667B7C2E7E3EBF77D
                                                                                                                                                                                                                          SHA1:EBF98AADB469C2D8B2795DEC61F9E3B6941F65D5
                                                                                                                                                                                                                          SHA-256:053FB7EF1C144F23AAD97DE1297257DA4D3C26E661B5C4297F953C053F161299
                                                                                                                                                                                                                          SHA-512:C65211ED840F089C2B73249E5139F904BD4DBADF355F268025D12921B2840E274A63BDA36D53A70990423FADA18A7841095C2CC4B0BE1540D992994C598C615B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.t.h.e.m.e.s.>.......<.w.i.n.d.o.w.>.........<.w.i.n.d.o.w._.s.l.i.d.e.r. .i.c.o.n._.p.o.i.n.t.=.".0.,.0.". .s.h.o.w._.i.c.o.n.=.".0.". .>...........<.c.a.n.v.a.s. .n.o.r.m.a.l.=.".0.x.f.f.f.f.f.f.f.f.". .i.m.a.g.e.=.".". .f.i.l.l.=.".1."./.>...........<.b.o.r.d.e.r. .n.o.r.m.a.l.=.".0.x.f.f.f.f.f.f.f.f.". .w.i.d.t.h.=.".0.". .i.n.n.e.r.=.".0.x.f.f.f.f.f.f.f.f."./.>.........<./.w.i.n.d.o.w._.s.l.i.d.e.r.>.........<.w.i.n.d.o.w._.n.o.s.h.a.d.o.w. .i.c.o.n._.p.o.i.n.t.=.".4.,.4.".>...........<.c.a.n.v.a.s. .n.o.r.m.a.l.=.".0.x.0.0.0.0.0.0.0.0.". .i.m.a.g.e.=.".". .f.i.l.l.=.".0."./.>...........<.b.o.r.d.e.r. .n.o.r.m.a.l.=.".0.x.f.f.6.3.8.c.3.9.". .w.i.d.t.h.=.".0.". .i.n.n.e.r.=.".0.x.f.f.f.f.f.f.f.f."./.>...........<.c.a.p.t.i.o.n. .h.e.i.g.h.t.=.".0.". .c.o.l.o.r.=.".0.x.f.f.f.f.f.f.f.f."./.>...........<.s.h.a.d.o.w. .b.o.r.d.e.r.=.".0.,.0.,.0.,.0.". .i.m.a.g.e.=.".../.c.o.m.m.o.n./.i.m.a.g.e./.W.i.n.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\theme.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):280256
                                                                                                                                                                                                                          Entropy (8bit):3.5597264004236266
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:1tZ1cAQcB6C9De7PBE1BIjE5sfkHX8/6KWmNloOrNsq4Kp4txEk88288E+engSLW:1L1ZQgxKBE75sfkooOrkEu+e2Dr3
                                                                                                                                                                                                                          MD5:8EE7254EE8E9F168970CE4C6F6CEFDB8
                                                                                                                                                                                                                          SHA1:CEF726679B56A1F89EBB6FC9B0EBC05CAB196385
                                                                                                                                                                                                                          SHA-256:D7030ACDCB15E89E3E201D379354B48B9637E3F199EC469A5B95C5289FC184F2
                                                                                                                                                                                                                          SHA-512:67FFDC5A2F7BC5CDD7FA9BA099CCC94ACD16BA792BA17A2A63096B3D0A7AE71E9AE54CEFCD5133526FA8D92746BC60ED1883E0987A483909C3961C6AB5041285
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.t.h.e.m.e.s.>.......<.w.i.n.d.o.w.>.........<.w.i.n.d.o.w._.d.e.f.a.u.l.t. .i.c.o.n._.p.o.i.n.t.=.".4.,.4.". .s.h.o.w._.i.c.o.n.=.".0.".>...........<.c.a.n.v.a.s. .n.o.r.m.a.l.=.".0.x.0.0.f.f.f.f.f.f.". .i.m.a.g.e.=.".". .f.i.l.l.=.".1."./.>...........<.b.o.r.d.e.r. .n.o.r.m.a.l.=.".0.x.f.f.6.3.8.c.3.9.". .w.i.d.t.h.=.".0.". .i.n.n.e.r.=.".0.x.f.f.f.f.f.f.f.f."./.>...........<.s.h.a.d.o.w. .b.o.r.d.e.r.=.".1.0.,.1.0.,.1.0.,.1.0.". .i.m.a.g.e.=.".../.c.o.m.m.o.n./.i.m.a.g.e./.W.i.n.d.o.w._.d.e.f.a.u.l.t._.s.h.a.d.o.w...p.n.g."./.>...........<.c.a.p.t.i.o.n. .h.e.i.g.h.t.=.".3.6.". .c.o.l.o.r.=.".0.x.f.f.4.c.b.4.0.7.". .s.h.o.w.=.".0."./.>...........<.s.y.s.t.e.m._.b.u.t.t.o.n. .o.f.f.s.e.t._.p.o.s.=.".5.". .c.a.p.=.".0.". .t.o.p.=.".7.".>.............<.c.l.o.s.e. .w.i.d.t.h.=.".2.2.". .h.e.i.g.h.t.=.".2.2.". .i.m.a.g.e.=.".../.c.o.m.m.o.n./.i.m.a.g.e./.i.c.o.n._.t.o.p.b.a.r._.c.l.o.s.e._.l.i.g.h.t...p.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\theme_DuplicateFile.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):69616
                                                                                                                                                                                                                          Entropy (8bit):3.5957656018575057
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:LNK3RqRKNMgq3bn25HrOFqRyRTkyk294jTlj+NSljn2yljn+ylj+WlOljnsljne9:LNKBfppn9pnVvEpnspnepSZF4
                                                                                                                                                                                                                          MD5:5D8FEF28A68A6BA57AE4B75C9CB807D7
                                                                                                                                                                                                                          SHA1:1C36A550C55124A44D8251A41EA46B13D9002352
                                                                                                                                                                                                                          SHA-256:A622072BF199752C487EA162AE235B7352B74E18947A2640950E2F8A101A5CB2
                                                                                                                                                                                                                          SHA-512:C094CC110AE41DF3FBC9CBDCD33A42691E9A9EDE62C6F6EAD8896118BC9FBCD8CC83AA5ECCD8D3CB087E476449E17CD6522B2BA6CF3E344E2B530992DF80D574
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.t.h.e.m.e.s.>.......<.w.i.n.d.o.w.>.........<.M.e.s.s.a.g.e.B.o.x. .i.c.o.n._.p.o.i.n.t.=.".4.,.4.".>...........<.c.a.n.v.a.s. .n.o.r.m.a.l.=.".0.x.f.f.7.7.c.b.0.0.". .i.m.a.g.e.=.".". .f.i.l.l.=.".0."./.>...........<.b.o.r.d.e.r. .n.o.r.m.a.l.=.".0.x.f.f.6.3.8.c.3.9.". .w.i.d.t.h.=.".0.". .i.n.n.e.r.=.".0.x.f.f.f.f.f.f.f.f."./.>...........<.f.o.n.t. .f.a.c.e.=.".._o...,..[SO,.T.a.h.o.m.a.". .c.o.l.o.r.=.".0.x.0.0.b.5.e.5.1.3.". .s.i.z.e.=.".8.". .b.o.l.d.=.".0.". .i.t.a.l.i.c.=.".0.". .u.n.d.e.r.l.i.n.e.=.".0."./.>...........<.s.h.a.d.o.w. .b.o.r.d.e.r.=.".5.,.3.,.5.,.7.". .i.m.a.g.e.=.".D.u.p.l.i.c.a.t.e.F.i.l.e.\.I.m.a.g.e.\.w.i.n.d.o.w._.s.h.a.d.o.w...p.n.g."./.>...........<.c.a.p.t.i.o.n. .h.e.i.g.h.t.=.".2.9.". .c.o.l.o.r.=.".0.x.f.f.f.f.f.f.f.f."./.>...........<.s.y.s.t.e.m._.b.u.t.t.o.n. .o.f.f.s.e.t._.p.o.s.=.".0.". .c.a.p.=.".0.". .t.o.p.=.".0.".>.............<.c.l.o.s.e. .w.i.d.t.h.=.".3.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\tools\Tools_config.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):400
                                                                                                                                                                                                                          Entropy (8bit):7.373987264587646
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:65EJVVZvtPTNjHa5WoPudYzqAX7nxrn+Vp3DKGB:jLVT9Ha5WodX7nR+KGB
                                                                                                                                                                                                                          MD5:923A0C674EFFDF4408C19589866A88E2
                                                                                                                                                                                                                          SHA1:3B1C073870A30CC2DF670E1A54EF9E7398A84D5A
                                                                                                                                                                                                                          SHA-256:6B13E572DB1C22A865F41AE7FF0E3D8760A5D19042B346371FFF2B0C4A09C85F
                                                                                                                                                                                                                          SHA-512:15D3BFDFD8F137910FD2D8B84B005D83B55216BF4AFF52B6E92ED2CAA09AA6EA7AA7DB8251277E8A061EF546E00CF50E55F4E248CE7065FA0291A06789B91E97
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:FCST........g...................k).Mt(._..|.n..:)..-......{..R....@....I..*M.......a#....|.`.... fF........'....Apn[.:..ypT.K.9...or.....MC...Q=.)D.f.%*..~....j..Q.|@F....'........eh.......{uI....J..C....^P..hv.*.-.Q....:`....1.Q..0c0.dw..V.Y@;Hk."....\#4.w.3...)Q..#....<.N..T..FUf].RV../W3..|O.7............o..0..........`o.M..l.<..g..[Bu........c.....~.l.8D..;.j^.-.wX. .Jl..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\default\tools\Tools_theme.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):823154
                                                                                                                                                                                                                          Entropy (8bit):6.73010422488907
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:v44E4EfNWQI/zP5TXOjxYmcT48WlKFRhTizd3ztYD:v44hwnIT9XOjqWlQkzltC
                                                                                                                                                                                                                          MD5:BC5DE1C1CAC90BA9B71C6AA51113420C
                                                                                                                                                                                                                          SHA1:F8DD6292F4B4E9A69B31E19DECD8B8DDBA38D253
                                                                                                                                                                                                                          SHA-256:94C67E6DB3755BD752DD71D5695E2ABE395C18F96402663537930797202748EB
                                                                                                                                                                                                                          SHA-512:57F36933770C8B9412832C6E8316BC1113BC7864C9DE193EFB6B044FBC9CE7BE52183BC3CF7EDD7991EA575DC3920375F72A4ED3AAC0F2D34CD65F5925904FA2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK..........aT................DPI_240_image/PK..........aTe...E)..E)..'...DPI_240_image/app_360_security_icon.png.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...piTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:15c2ae4a-f633-4d30-b2fe-9c6d1fca285d" xmpMM:DocumentID="xmp.did:40D31D4FEA5E11E581BDF7287B051ED9" xmpMM:InstanceID="xmp.iid:40D31D4EEA5E11E581BDF7287B051ED9" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4102D87AFD2D11E4A5C3E147EB512A76" stRef:documentID="xmp.did:4102D87BFD2D11E4A5C3E147EB5

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\smurf\smurf.ui

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1725300
                                                                                                                                                                                                                          Entropy (8bit):7.743250384528679
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:kL77s5qov22FUzpzRkfTcdKLZzWn4IliNN/5CFn+TpsyPJd9b0N4zWm:kX7GqPlR2TcdWzowNfCFn+TfDFWm
                                                                                                                                                                                                                          MD5:1921C415BC0A6DBF2353EE8E7CDC6169
                                                                                                                                                                                                                          SHA1:EADCC6296779AB61CE4D1A4EE163603C2B1DAAD0
                                                                                                                                                                                                                          SHA-256:17FC81F0D1D421160115FECA57430CBE1709B12D1284DA7DB44B0E76D7168F3B
                                                                                                                                                                                                                          SHA-512:61983145F298D2BF0CD608AE655A016B1ACB22754E488E6471A16472F9C104581DF8A919713C85B5B71E80F63F36482A31AA4E4EBA9715BD58B1813682F87373
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........]z.Q................360CleanPlus/PK........]z.Q)...G...G.......360CleanPlus/icons.json{"version":1,"pages":[{"id":2000,"name":"main_page","controls":[{"id":2010,"parent_id":2000,"name":"scan_btn","bound":"584,50,754,90","icon_layers":[{"str":"IDS_BTN_SCAN,13,400","attr":"0x3","clrtheme":"func_btn2","bgclrtheme":"func_btn_bg2","borderclrtheme":"func_btn_border2","bgtype":"0,19,2,0,0","margin":"10,0,10,0"}]}]}]}PK........`z.Q................360internationsafe/PK........`z.Q................360internationsafe/anim/PK........`z.Q..(.P...P...#...360internationsafe/anim/config.json{"version":1,"animator":[{"id":8,"name":"fullcheck_tab_scan_anim","delay":0,"wait_duration":200,"interruptible":0,"repeat":1,"notifications":"visible","fps":28,"image":{"frames":14,"anim_strip":1,"src":[{"dpi":96,"filename":"tab\\96\\FullCheck_%03d.png"},{"dpi":240,"filename":"tab\\240\\Fullcheck2.5_%03d.png"}]}},{"id":9,"name":"virusscan_tab_scan_anim","delay":0,"wait_duration":500,"interruptible":0,"repe

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\newui\themes\smurf\smurf.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12873
                                                                                                                                                                                                                          Entropy (8bit):5.050098389350623
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:TUK5R5p56pefMMvj5feWcBYLuXIfJkd/cr5Us:TUK5R5p56pefMMvj5feWcBYLkIfJkd/o
                                                                                                                                                                                                                          MD5:250DC012DE09359503DE146669B3D127
                                                                                                                                                                                                                          SHA1:27707F1A938FA6E8CE26853ECE741F4E45DAFC50
                                                                                                                                                                                                                          SHA-256:978DF251514C77B1CD34173E20A5FEEC49811A1312CEE621CC70C5229FB10FD9
                                                                                                                                                                                                                          SHA-512:9F2186B9B2B59A64B0672D389BD265495E73965EEE083CC4269FF557DE7F13CA5EFA5B814359D4606828B5A919CE763FF876AD35F325A83A4C2DD0D19A7FA0C2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.<?xml version="1.0"?>..<themes version="9.0" ext="85f62681ad53f8dc7666ab0577c32982">...<panel>....<tool_header_bg>.....<canvas normal="0xff2866e7" radius="0" angle="0"/>.....<border normal="0xff2866e7" width="1"/>....</tool_header_bg>....<main_tab_bg>.....<canvas normal="0xff5189fc" radius="0" angle="0"/>.....<border normal="0xffdcedff" width="2"/>......<font color="0xffff0000"/>....</main_tab_bg>....<main_tab_bg_hover>.....<canvas normal="0xffffffff" radius="0" angle="0"/>.....<font color="0xff1f0000"/>....</main_tab_bg_hover>....<popup_tab_bg>.....<canvas normal="0xff4185ff" radius="0" angle="0"/>.....<border normal="0xff4185ff" width="2"/>......<font color="0xffff0000"/>....</popup_tab_bg>....<popup_tab_bg_hover>.....<canvas normal="0xfff7f7f7" radius="0" angle="0"/>.....<font color="0xffff0000"/>....</popup_tab_bg_hover>......<sub_tab_bg>.....<canvas normal="0xff5189fc" radius="0" angle="0"/>.....<border normal="0xffdcedff" width="2"/>......<font color="0xffff0000"/>....</sub_ta

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\FirstPrioritySupport.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):964
                                                                                                                                                                                                                          Entropy (8bit):3.5394638406365564
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:QF/LXYRWe82yAitPjF1QE6gFxFVjD+Zywy4jEEpPpSSlreELIm4sxq1w4q1IAyPn:QlL+xTibDT4ZywyVEpPpwELIDO2w42Ny
                                                                                                                                                                                                                          MD5:F92198CD18B2DAEF9B7CF2E22635AA61
                                                                                                                                                                                                                          SHA1:61C006EB2FD890761C3D2107D71C7509C696EA5C
                                                                                                                                                                                                                          SHA-256:B54C85A919F972B097953FD4297AC0D180263FCAFCA9B081E2C8ADFFF968A9C6
                                                                                                                                                                                                                          SHA-512:84A18D3E003E533943E82301A0B765710F33DBBE13178ED2EA128A0E00EC873C577FAA3BEE232AE7C8D97E695F46733C9AFC82038AC1D277ED910C965A488872
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.2.7.".........i.d.s.=.".F.i.r.s.t.P.r.i.o.r.i.t.y.S.u.p.p.o.r.t.".........g.r.o.u.p.=.".3.0.0.0.0.".........o.r.d.e.r.=.".4.0.0.".........s.h.o.w.=.".0.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.P.R.I.O.R.I.T.Y._.S.U.P.P.O.R.T.".........t.i.p.=.".I.D.S._.P.R.I.O.R.I.T.Y._.S.U.P.P.O.R.T._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".1.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.a.0.c.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.4.8.".........a.d.m.i.n.t.o.o.l.=.".0.".......>.........<.e.x.e. .t.y.p.e.=.".r.e.l.a.t.i.v.e.".........p.a.t.h.=.".F.e.e.d.B.a.c.k...e.x.e.".........a.r.g.=.".".........b.i.t.=."."........./.>.......<./.t.o.o.l.>.......<./.t.o.o.l._.l.i.s.t.>.....<./.r.o.o.t.>.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\FirstPriorityUpdate.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1102
                                                                                                                                                                                                                          Entropy (8bit):3.6055132344426775
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTich94ch94hqHZywyVEpip1qtExUgE2w42Ny:y+xTvhqchqsonVPqt5gE2F2Ny
                                                                                                                                                                                                                          MD5:8A9888D0F6235943DB9B385BB78A6F03
                                                                                                                                                                                                                          SHA1:A3BC726CFA6475822C70514B371719BC362576DC
                                                                                                                                                                                                                          SHA-256:7A02ACF7853FDE71A179678EE0753BBF2E9A80B635A3AC87D686DD56B53A902B
                                                                                                                                                                                                                          SHA-512:89A0C18AF925D7967B7E2864349DB81DD0627E0091750A6963A7E83736253977C0DBFC7C18BA4EFDCC9BC73452477AC43FD82D12654DB06195736B178235C958
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.3.3.".........i.d.s.=.".F.i.r.s.t.P.r.i.o.r.i.t.y.U.p.d.a.t.e.".........g.r.o.u.p.=.".3.0.0.0.0.".........o.r.d.e.r.=.".2.6.0.".........s.h.o.w.=.".1.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.T.O.O.L._.F.I.R.S.T._.P.R.I.O.R.I.T.Y._.U.P.D.A.T.E.".........t.i.p.=.".I.D.S._.T.O.O.L._.F.I.R.S.T._.P.R.I.O.R.I.T.Y._.U.P.D.A.T.E._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".1.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.a.8.0.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.8.1.".........a.d.m.i.n.t.o.o.l.=.".1."..... . . . . . . . .f.o.r.b.i.d.b.i.z.=.".1."....... . . . .>.........<.e.x.e. .t.y.p.e.=.".r.e.l.a.t.i.v.e.".........p.a.t.h.=.".Q.H.S.a.f.e.M.a.i.n...e.x.e.".........a.r.g.=."./.s.e.t.t.i.n.g.s. ./.a.u.t.o.u.p.d.a.t.e.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\GameBooster.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1634
                                                                                                                                                                                                                          Entropy (8bit):3.5969666381776824
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTi6KPKvZywLVExlp6nw9sn+lME3dy5GH8Hy9JJ2w42Ny:y+xT5y3OVwz0JkkS9JJ2F2Ny
                                                                                                                                                                                                                          MD5:E63B056706CD81DBDA0D5FE1D5A2CA4F
                                                                                                                                                                                                                          SHA1:F684224A056934B6E79B833DD69336A1B3AAB420
                                                                                                                                                                                                                          SHA-256:968539900165AFAD914C4C780D736F3A859F2973D90B0169EC0DFBE46A9D3ADE
                                                                                                                                                                                                                          SHA-512:82ED440818AE8C3C13D01D00B9AF595479CAF22E20ABBF1EFEFCC335DA08949C9A9526098D97D7E57ECA995E889C03A115D1EA4592A7896E15F3753B3CA136FB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.1.2.".........i.d.s.=.".G.a.m.e.B.o.o.s.t.e.r.".........g.r.o.u.p.=.".2.0.0.0.0.".........o.r.d.e.r.=.".2.7.0.".........s.h.o.w.=.".1.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.T.O.O.L._.G.A.M.E.B.O.O.S.T.E.R.".........t.i.p.=.".I.D.S._.T.O.O.L._.G.A.M.E.B.O.O.S.T.E.R._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".0.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.9.b.c.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.4.9.".........a.d.m.i.n.t.o.o.l.=.".1.".......>...............<.i.n.s.t.a.l.l. ...........p.r.o.m.p.t.w.n.d.=.".0."...........t.y.p.e.=.".v.3.". ...........p.d.o.w.n.3.2.=.".h.t.t.p.:././.u.p.d.a.t.e...3.6.0.s.a.f.e...c.o.m./.v.3./.a.d.v.g.a.m.e.b.o.o.s.t.e.r...c.a.b."...........p.d.o.w.n.6.4.=.".h.t.t.p.:././.u.p.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\InstantSetup.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1138
                                                                                                                                                                                                                          Entropy (8bit):3.558481705055535
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTi6KHygZywLVEx8p//6UEEJO2w42Ny:y+xTMy3OVwAvRO2F2Ny
                                                                                                                                                                                                                          MD5:38B0D3F6341C9AD46BE72CC90F0B1A8D
                                                                                                                                                                                                                          SHA1:904E6D339601F98583B2A050116AC0412B532013
                                                                                                                                                                                                                          SHA-256:9C81D5E552A09FF67BF1E53722D6D4127CC6FCBBE5260E4D9F6FE26A16224536
                                                                                                                                                                                                                          SHA-512:517FB42A1A7FA5ED26ED804A2B3657109F42E017FC2A9FD45EAEA94587B2B24C0F57352CE56070854BA1B1E6A2F387B4D22048C11A90355EAAAC5F66D94CCB51
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.0.9.".........i.d.s.=.".I.n.s.t.a.n.t.S.e.t.u.p.".........g.r.o.u.p.=.".0.".........o.r.d.e.r.=.".2.2.0.".........s.h.o.w.=.".1.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.T.O.O.L._.I.N.S.T.A.N.T.S.E.T.U.P.".........t.i.p.=.".I.D.S._.T.O.O.L._.I.N.S.T.A.N.T.S.E.T.U.P._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".0.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.9.1.c.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.4.c.".........a.d.m.i.n.t.o.o.l.=.".1.".......>.........<.f.i.l.t.e.r. .t.y.p.e.=.".e.x.c.l.u.d.e.".>...........<.s.y.s. .v.e.r.=.".5...2."./.>...........<.s.y.s. .v.e.r.=.".6...0."./.>.........<./.f.i.l.t.e.r.>.........<.e.x.e. .t.y.p.e.=.".r.e.l.a.t.i.v.e.".........p.a.t.h.=.".s.o.f.t.m.g.r.\.3.6.0.I.n.s.t.a.n.t.S.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\MobileSecurity.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1044
                                                                                                                                                                                                                          Entropy (8bit):3.590197790646538
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTs9u6aDEF4kDEFVYWtwCkExB4pu4yGrk+r39Tw42Ny:y+xTsMp4r4H3/kwBWkERF2Ny
                                                                                                                                                                                                                          MD5:5D60A4B60C81BF0D776F343E1ACE68E6
                                                                                                                                                                                                                          SHA1:CF3A540478D69006436159415AC04942AB6F6D67
                                                                                                                                                                                                                          SHA-256:09DA4E23872C00AA3BA3925E091CA4DE7FACB4C07FBDF85A2D516D57355B7FD9
                                                                                                                                                                                                                          SHA-512:95AAC36E06DB5090E4593B0E08E571FD0D13A2A04D90B8488B24CF5FF959279A9C111E200A87F9DBA163CD2CF041F913758C2429FB880CF258D33CF668EF3493
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. ...........i.d.=.".1.0.1.8."...........i.d.s.=.".M.o.b.i.l.e.S.e.c.u.r.i.t.y."...........g.r.o.u.p.=.".1.0.0.0.0."...........o.r.d.e.r.=.".2.0.0."...........s.h.o.w.=.".0.".....................n.a.m.e.=.".I.D.S._.T.O.O.L._.M.O.B.I.L.E._.S.E.C.U.R.I.T.Y."...........t.i.p.=.".I.D.S._.T.O.O.L._.M.O.B.I.L.E._.S.E.C.U.R.I.T.Y._.T.I.P.".....................b.e.t.a.=.".0.". ...........n.e.w.=.".0.". ...........p.r.e.m.i.u.m.=.".0."...........p.a.t.h.c.h.e.c.k.=.".0."...........i.c.o.n.p.a.t.h.=.".0.x.e.9.c.b."...........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.3.d."...........a.d.m.i.n.=.".0.".........>...........<.e.x.e. .t.y.p.e.=.".w.e.b.". .p.a.t.h.=.".h.t.t.p.:././.w.w.w...3.6.0.o.v.e.r.s.e.a.s...c.o.m./.?.u.t.m._.s.o.u.r.c.e.=.t.s.&.u.t.m._.m.e.d.i.u.m.=.t.o.o.l.b.o.x.". .a.r.g.=.".". .b.i.t.=.".". ./.>...................<./.t.o.o.l.>.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\NoAds.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):942
                                                                                                                                                                                                                          Entropy (8bit):3.482240471129896
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTiNIyTyLZywyVEpQapbq8EEw42Ny:y+xTOIG7nVCq8VF2Ny
                                                                                                                                                                                                                          MD5:3CF1995DE72A91E11F86E4AD46CF887F
                                                                                                                                                                                                                          SHA1:BD6C9790E0AE72650E2B4D3693AFB472F03B9024
                                                                                                                                                                                                                          SHA-256:A8C410C5E3629AB542D3C5C90F2A4B6B3BA0E49A22EFFB59DAF0D427E7873837
                                                                                                                                                                                                                          SHA-512:48A1C62A9C5777407580F27D395C82CA80D90CC08D30C520300BA34090AB310FBD5C3D77EDB7C9866B8C2126C0E94D687D254E19455AC587CEBA985DEA76DE3F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.2.9.".........i.d.s.=.".N.o.A.d.s.".........g.r.o.u.p.=.".3.0.0.0.0.".........o.r.d.e.r.=.".4.2.0.".........s.h.o.w.=.".0.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.T.O.O.L._.N.O._.A.D.S.".........t.i.p.=.".I.D.S._.T.O.O.L._.N.O._.A.D.S._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".1.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.a.0.e.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.4.b.".........a.d.m.i.n.t.o.o.l.=.".0.".........f.o.r.b.i.d.b.i.z.=.".1.".........>...........<.e.x.e. .t.y.p.e.=.".o.t.h.e.r."...........p.a.t.h.=.".N.o.A.d.s."...........a.r.g.=."."...........b.i.t.=.".".........../.>.........<./.t.o.o.l.>.......<./.t.o.o.l._.l.i.s.t.>.....<./.r.o.o.t.>.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\PatchUp.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):954
                                                                                                                                                                                                                          Entropy (8bit):3.5278988943703093
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTiEAininZywLVExvpKlTEra+Ux2w42Ny:y+xTA6fOVwqJ+A2F2Ny
                                                                                                                                                                                                                          MD5:94A8EDA0DC201C6F675CA3E4C324155E
                                                                                                                                                                                                                          SHA1:8AB26AF7AFDCA3ED5B7EA176672E9AAB77490429
                                                                                                                                                                                                                          SHA-256:8DC22982025C06B05405D37A7CB6C0E28E983315F3A0BA09C5E48B590A2FEA13
                                                                                                                                                                                                                          SHA-512:15CAC9014709CC06645B08CC87F0CFF8BE9DB5FB63CCA8763DB597AB0C3A19EFA449B7676D5C6DFD5BCB5CD75756A0C916721002414C61936D6745B60C419645
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.0.0.".........i.d.s.=.".P.a.t.c.h.U.p.".........g.r.o.u.p.=.".1.0.0.0.0.".........o.r.d.e.r.=.".1.2.0.".........s.h.o.w.=.".1.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.T.O.O.L._.P.A.T.C.H._.U.P.".........t.i.p.=.".I.D.S._.T.O.O.L._.P.A.T.C.H._.U.P._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".0.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.9.2.1.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.5.4.".........a.d.m.i.n.t.o.o.l.=.".1.".......>.........<.e.x.e. .t.y.p.e.=.".r.e.l.a.t.i.v.e.".........p.a.t.h.=.".P.a.t.c.h.U.p...e.x.e.".........a.r.g.=."./.s.t.a.r.t.m.a.i.n.w.n.d.=.1.".........b.i.t.=."."........./.>.......<./.t.o.o.l.>.......<./.t.o.o.l._.l.i.s.t.>.....<./.r.o.o.t.>.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\PremiumTheme.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):954
                                                                                                                                                                                                                          Entropy (8bit):3.5340863382383523
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTiXwRliNW1WdHZywyVEp58pisEQpTtq2w42Ny:y+xTyDMUdonV0VszpTtq2F2Ny
                                                                                                                                                                                                                          MD5:255F4A6420F878AA6027F25D5C772C7D
                                                                                                                                                                                                                          SHA1:BF07778F2A6112E51439417595EE38BEA46EFC12
                                                                                                                                                                                                                          SHA-256:4D1B690FF93509435D9532DCD89C8FE432BDC147B9C90BE638F5E33B5A041744
                                                                                                                                                                                                                          SHA-512:B22D07C77EB916BBC9BC96984053B9335DDBDD941E2C61A38972D633BC4862D70641CE1169DA894DDE3ED1DF46414CFDA4B2586C5A0164E3F908163F45FA450B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.2.6.".........i.d.s.=.".P.r.e.m.i.u.m.T.h.e.m.e.".........g.r.o.u.p.=.".3.0.0.0.0.".........o.r.d.e.r.=.".4.3.0.".........s.h.o.w.=.".0.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.L.I.V.E.L.Y._.T.H.E.M.E.".........t.i.p.=.".I.D.S._.L.I.V.E.L.Y._.T.H.E.M.E._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".1.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.a.0.d.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.4.a.".........a.d.m.i.n.t.o.o.l.=.".0.".......>.........<.e.x.e. .t.y.p.e.=.".r.e.l.a.t.i.v.e.".........p.a.t.h.=.".3.6.0.S.k.i.n.V.i.e.w...e.x.e.".........a.r.g.=."./.t.a.b.=.v.i.p.".........b.i.t.=."."........./.>.......<./.t.o.o.l.>.......<./.t.o.o.l._.l.i.s.t.>.....<./.r.o.o.t.>.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\QuickSearch.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1156
                                                                                                                                                                                                                          Entropy (8bit):3.590934778096121
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTidotNomqt2Bd2mqZywLVEpHp9X6UEkIh7l72w42Ny:y+xTMqNfqtmd55OVEvih72F2Ny
                                                                                                                                                                                                                          MD5:61F50F9740E19237338ECD759F8DFAC6
                                                                                                                                                                                                                          SHA1:5195BD02FDAA1416193A25CA504CBCC7A17F66A2
                                                                                                                                                                                                                          SHA-256:EA826C3BDF6A139AE2F3C8593508D4CA1AE5D910DCDEBD3223E6D4CABA858BD5
                                                                                                                                                                                                                          SHA-512:325EA3BC24B22B969445902A2E336165E6D15E2E71D7C91847E431C1285C1C067A3CF52B057BB08FF42CCD65FB9449127272DD6B27EC848C7F94D832E2B729E7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.3.8.".........i.d.s.=.".Q.u.i.c.k.S.e.a.r.c.h.".........g.r.o.u.p.=.".".........o.r.d.e.r.=.".1.7.0.".........s.h.o.w.=.".1.".........f.o.r.b.i.d.b.i.z.=.".1.".................l.a.n.g.=.".r.u.".........n.a.m.e.=.".I.D.S._.T.O.O.L._.Q.U.I.C.K._.S.E.A.R.C.H.".........t.i.p.=.".I.D.S._.T.O.O.L._.Q.U.I.C.K._.S.E.A.R.C.H._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".0.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.a.8.c.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.8.d.".........a.d.m.i.n.t.o.o.l.=.".0.".......>.........<.f.i.l.t.e.r. .t.y.p.e.=.".e.x.c.l.u.d.e.".>...........<.s.y.s. .v.e.r.=.".1.0...0."./.>.........<./.f.i.l.t.e.r.>.........<.e.x.e. .t.y.p.e.=.".r.e.l.a.t.i.v.e.".........p.a.t.h.=.".s.o.f.t.m.g.r.\.S.M.L.\.S.o.f.t.M.g.r.L.i.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\RansomwareDecryptor.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2242
                                                                                                                                                                                                                          Entropy (8bit):3.6103577339250217
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:y+xTsifRAyKAyjQ/kwQ3rvwVFZGVFVPrvwVFZbhF2Ny:BsiqyHy+kwRrCy
                                                                                                                                                                                                                          MD5:0190F7BBAE83A041DE837570D060EFAF
                                                                                                                                                                                                                          SHA1:DECF364DE242EEBB665BBD95333FD7797EAB5D91
                                                                                                                                                                                                                          SHA-256:98BD63053EA4CA3DFE0789268131870646C63D0044A4C34C82ACE71CB9F7A584
                                                                                                                                                                                                                          SHA-512:D842CCB0437366E4F55B848D3A675B49FFB99F7442B950E58468C65D44DD2470E6E4CB6661BA389687519FC10CDDD3A15ED2709D1D418E2D1458D1FCC9ADC29F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. ...........i.d.=.".1.0.1.3."...........i.d.s.=.".R.a.n.s.o.m.w.a.r.e.D.e.c.r.y.p.t.o.r."...........g.r.o.u.p.=.".1.0.0.0.0."...........o.r.d.e.r.=.".3.0.0."...........s.h.o.w.=.".1.".....................n.a.m.e.=.".I.D.S._.T.O.O.L._.R.A.N.S.O.M.W.A.R.E."...........t.i.p.=.".I.D.S._.T.O.O.L._.R.A.N.S.O.M.W.A.R.E._.T.I.P.".....................b.e.t.a.=.".0.". ...........n.e.w.=.".0.". ...........p.r.e.m.i.u.m.=.".0."...........p.a.t.h.c.h.e.c.k.=.".0."...........i.c.o.n.p.a.t.h.=.".0.x.e.9.b.e."...........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.4.e."...........a.d.m.i.n.t.o.o.l.=.".1.".........>...........<.i.n.s.t.a.l.l. .t.y.p.e.=.".s.e.t.u.p.". ...........p.r.o.m.p.t.w.n.d.=.".0."...........r.e.g.r.o.o.t.=.".H.K.L.M.". ...........r.e.g.p.a.t.h.=.".S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.A.p.p.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\Sandbox.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):934
                                                                                                                                                                                                                          Entropy (8bit):3.531436520718471
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTiOlDeXae3oZywLVExEpKlyEcO2w42Ny:y+xT9lDeXaevOVwynO2F2Ny
                                                                                                                                                                                                                          MD5:4FD05CD8BE37FC0DCEF72C8881D10434
                                                                                                                                                                                                                          SHA1:E0B8084FD5B811553C2FA602B1A217F03BAC2636
                                                                                                                                                                                                                          SHA-256:17F3F8C92D23BBCDCAD982AEAD237A194DE1462C3F5DCF87A46462A24A757CA6
                                                                                                                                                                                                                          SHA-512:7A0B5487496A687A4FCC0A141211AD7295CBC050F396CEE9B458966F5A1431BDDD5021C1314D65B9D60964E324281FCA5CBF385E51DB61A48BB2CD09243CAE0D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.0.1.".........i.d.s.=.".S.a.n.d.B.o.x.".........g.r.o.u.p.=.".1.0.0.0.0.".........o.r.d.e.r.=.".2.5.0.".........s.h.o.w.=.".1.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.T.O.O.L._.S.A.N.D.B.O.X.".........t.i.p.=.".I.D.S._.T.O.O.L._.S.A.N.D.B.O.X._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".0.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.9.2.0.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.5.5.".........a.d.m.i.n.t.o.o.l.=.".1.".......>.........<.e.x.e. .t.y.p.e.=.".r.e.l.a.t.i.v.e.".........p.a.t.h.=.".i.p.c.\.3.6.0.b.o.x.m.a.i.n...e.x.e.".........a.r.g.=.".".........b.i.t.=."."........./.>.......<./.t.o.o.l.>.......<./.t.o.o.l._.l.i.s.t.>.....<./.r.o.o.t.>.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\ScheduledClean.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1006
                                                                                                                                                                                                                          Entropy (8bit):3.577563974561798
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTirTCp0+z0+dZywyVEp4pKl+ExUgO92w42Ny:y+xTmTCp0+z0+unV95gO92F2Ny
                                                                                                                                                                                                                          MD5:6939D7C55C879695FA7BD03380381590
                                                                                                                                                                                                                          SHA1:41290205DA25B6D7A5A614B5761D7BF3966DDB03
                                                                                                                                                                                                                          SHA-256:5BFED64001C150A52F8E1790D9D224FC0DCDD60837D86FB0B1922F91030D9FCC
                                                                                                                                                                                                                          SHA-512:1E14BAAD0760783E67BCD5D4ACD9AFF1356AEADF0BEF123517129BF378F8EF72DDF619391E4C1625AD0B5CB5698C55EA1166C504913219C4217746C6734ACF8B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.2.8.".........i.d.s.=.".S.c.h.d.u.l.e.d.C.l.e.a.n.".........g.r.o.u.p.=.".2.0.0.0.0.,.3.0.0.0.0.".........o.r.d.e.r.=.".1.9.0.".........s.h.o.w.=.".1.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.S.C.H.E.D.U.L.E._.C.L.E.A.N.U.P.".........t.i.p.=.".I.D.S._.S.C.H.E.D.U.L.E._.C.L.E.A.N.U.P._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".1.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.a.0.f.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.5.0.".........a.d.m.i.n.t.o.o.l.=.".0.".......>.........<.e.x.e. .t.y.p.e.=.".r.e.l.a.t.i.v.e.".........p.a.t.h.=.".Q.H.S.a.f.e.M.a.i.n...e.x.e.".........a.r.g.=."./.s.e.t.t.i.n.g.s. ./.s._.c.l.e.a.n.u.p.".........b.i.t.=."."........./.>.......<./.t.o.o.l.>.......<./.t.o.o.l._.l.i.s.t.>.....<./.r.o.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\SpecialOffer.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):998
                                                                                                                                                                                                                          Entropy (8bit):3.5350600960327014
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTiAxax2/3x2/XZywyVEptpKlLoq8E4xbw42Ny:y+xTjsxWxLnVfoq8pNF2Ny
                                                                                                                                                                                                                          MD5:14DCDF37E7C544360F3A7F7901DDD61C
                                                                                                                                                                                                                          SHA1:6C691C6E34CF1481E4A961F0A88D1F2ADBD1E77F
                                                                                                                                                                                                                          SHA-256:76D2A501246207EB3FB9F2B7F3AF00091842160A32EF00192F87EE969371B222
                                                                                                                                                                                                                          SHA-512:699D5EBAB4DF1BDC4996AD01774CAC213E81327F2BC650E2BE8431DE732C29B537E16AAF804D04E1AE49E924C97096A62C9EF284BFA7E4EC58C252140CD51090
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.2.5.".........i.d.s.=.".S.p.e.c.i.a.l.O.f.f.e.r.".........g.r.o.u.p.=.".3.0.0.0.0.".........o.r.d.e.r.=.".4.1.0.".........s.h.o.w.=.".0.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.T.O.O.L._.S.P.E.C.I.A.L._.O.F.F.E.R.".........t.i.p.=.".I.D.S._.T.O.O.L._.S.P.E.C.I.A.L._.O.F.F.E.R._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".1.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.a.1.0.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.5.1.".........a.d.m.i.n.t.o.o.l.=.".0.".........f.o.r.b.i.d.b.i.z.=.".1.".........>...........<.e.x.e. .t.y.p.e.=.".o.t.h.e.r."...........p.a.t.h.=.".S.p.e.c.i.a.l.O.f.f.e.r."...........a.r.g.=."."...........b.i.t.=.".".........../.>.........<./.t.o.o.l.>.......<./.t.o.o.l._.l.i.s.t.>.....<./.r.o.o.t.>.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\SuperKiller.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1626
                                                                                                                                                                                                                          Entropy (8bit):3.6577663184180587
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTiWXGb3f6fIZywLVEpabpdFF9sn+ubsxQbLD9MESmtCErmySmtCiJ2w42Ny:y+xTbXaSXOVFX02I+6BJ2F2Ny
                                                                                                                                                                                                                          MD5:D656B3313A998024FED7780402FFC6A3
                                                                                                                                                                                                                          SHA1:1D4FD909EB65D3951BE755A43E66749CB3DD3384
                                                                                                                                                                                                                          SHA-256:45081D5D5E0B41D6D2D50AA6F792C631847D4E6C499DD04D764DE58CE435D961
                                                                                                                                                                                                                          SHA-512:1DF6C02113F8D5754F4ED03E19BEEB9F0F4D4B4D4FD0B0E0F4EFEC8903C4246FCED42D7C82A7BA0F10636B9B4FAA235C779F169E7CE3DA9B1E9E4D31F93B8EC6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.4.1.".........i.d.s.=.".3.6.0.X.i.T.o.n.g.J.i.J.i.u.X.i.a.n.g.".........g.r.o.u.p.=.".1.0.0.0.0.".........o.r.d.e.r.=.".2.9.0.".........s.h.o.w.=.".1.".................l.a.n.g.=.".z.h.-.C.N.,.z.h.-.T.W.".........n.a.m.e.=.".I.D.S._.T.O.O.L._.S.U.P.E.R.K.I.L.L.E.R.".........t.i.p.=.".I.D.S._.T.O.O.L._.S.U.P.E.R.K.I.L.L.E.R._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".0.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.a.9.c.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.9.d.".........a.d.m.i.n.t.o.o.l.=.".1.".......>.........<.f.i.l.t.e.r. .t.y.p.e.=.".e.x.c.l.u.d.e.".>.........<./.f.i.l.t.e.r.>.........<.i.n.s.t.a.l.l. ...........p.r.o.m.p.t.w.n.d.=.".0."...........t.y.p.e.=.".v.3.". ...........p.d.o.w.n.3.2.=.".h.t.t.p.:././.u.p.d.a.t.e...3.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\SysCleaner.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1160
                                                                                                                                                                                                                          Entropy (8bit):3.5853716327026626
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTiLGM3GMXZywyVEpxpkEnYy4fc7JJ2w42Ny:y+xTQl3lYnVrcWIJJ2F2Ny
                                                                                                                                                                                                                          MD5:A5289D010D8C1D206492B6D7D2796DD5
                                                                                                                                                                                                                          SHA1:D3DAFBD7BE8C328EE29DE5F4BABB1C38C4E23CE8
                                                                                                                                                                                                                          SHA-256:FCCFCA2738C39D2F8F6B0D3F69CFE88CE033F50D358473B57519E2C5A42084DA
                                                                                                                                                                                                                          SHA-512:D717E3DEF94A90282AC35AAA8D9EDA2E0E9FA62A37C0F6FA9ACCD2B06596A52CD4CC3756D54EFA8949AE2FC238366B1D5036C3A6A8A70D3F6C5676C5A5169D69
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.3.6.".........i.d.s.=.".S.y.s.C.l.e.a.n.e.r.".........g.r.o.u.p.=.".2.0.0.0.0.,.3.0.0.0.0.".........o.r.d.e.r.=.".2.0.0.".........s.h.o.w.=.".1.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.T.O.O.L._.S.Y.S.C.L.E.A.N.E.R.".........t.i.p.=.".I.D.S._.T.O.O.L._.S.Y.S.C.L.E.A.N.E.R._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".1.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.a.8.e.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.8.f.".........a.d.m.i.n.t.o.o.l.=.".1.".......>.............<.e.x.e. .t.y.p.e.=.".r.e.l.a.t.i.v.e.".........p.a.t.h.=.".U.t.i.l.s.\.S.y.s.C.l.e.a.n.e.r.U.I...e.x.e.".........a.r.g.=.".".........b.i.t.=.".".........>...................<.e.x.i.s.t. .p.a.t.h.=.".c.o.n.f.i.g.\.n.e.w.u.i.\.t.h.e.m.e.s.\.d.e.f.a.u.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\SystemCompact.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1996
                                                                                                                                                                                                                          Entropy (8bit):3.6274635498333816
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:y+xT+w303xOVwCx0yIdIYwvF+2nPlU3nQCmJJ2F2Ny:B/aYVwaNu1Xm0IHy
                                                                                                                                                                                                                          MD5:BD71C64D5F1BD7AACEE9547C02F90B9B
                                                                                                                                                                                                                          SHA1:F9E6EE8553621F1D117B2CD0CC4B278D37091C7A
                                                                                                                                                                                                                          SHA-256:2373B9945B751C8A527E680784277F193643C0A3F6D105A772EFAC4DD29834FB
                                                                                                                                                                                                                          SHA-512:2B45B3B2B22BE480D94E11ACAAB33DB199BD565C37070D2543878A821CEE97A14C7E5D542F807F1353A45D7914B977BDDC3D17351E2F9FF04A945511E12A46EE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.0.7.".........i.d.s.=.".S.y.s.t.e.m.C.o.m.p.a.c.t.".........g.r.o.u.p.=.".2.0.0.0.0.".........o.r.d.e.r.=.".1.0.0.9.0.".........s.h.o.w.=.".0.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.T.O.O.L._.S.Y.S.T.E.M.C.O.M.P.A.C.T.".........t.i.p.=.".I.D.S._.T.O.O.L._.S.Y.S.T.E.M.C.O.M.P.A.C.T._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".0.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.9.1.d.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.4.2.".........a.d.m.i.n.t.o.o.l.=.".1.".......>.........<.f.i.l.t.e.r. .t.y.p.e.=.".e.x.c.l.u.d.e.".>...........<.s.y.s. .v.e.r.=.".5...1."./.>...........<.s.y.s. .v.e.r.=.".5...2."./.>...........<.s.y.s. .v.e.r.=.".6...0."./.>.........<./.f.i.l.t.e.r.>.................<.i.n.s.t.a.l.l. ...........p.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\SystemRegClean.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1650
                                                                                                                                                                                                                          Entropy (8bit):3.6398484769537465
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTixe4RGZJGZZZywLVEx0bps9sn+yeLseL77E3eR+Uiy4WBQBWJJ2w42Ny:y+xTmROjOVwP0Gf//+zQJJ2F2Ny
                                                                                                                                                                                                                          MD5:A4045EC6BF8F92F1106CE677BF2BFAD2
                                                                                                                                                                                                                          SHA1:540BBC717CC96EAA0C77D152E5AAFF490828096A
                                                                                                                                                                                                                          SHA-256:20744C6E73E70A4E26BDD20F71C1804B671DE79527D287FFE2252CA6E64145D4
                                                                                                                                                                                                                          SHA-512:4CA4518D362F5A763889F77EB32FB90714CF1405BC21A3D08DB3D47193BF147A70FE37E7E78FBBD377BAE8EAE696E7CE4D81E40C71C2B0AC8B12C5B7B0F55D93
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.1.0.".........i.d.s.=.".S.y.s.t.e.m.R.e.g.i.s.t.r.y.C.l.e.a.n.".........g.r.o.u.p.=.".2.0.0.0.0.".........o.r.d.e.r.=.".1.8.0.".........s.h.o.w.=.".1.".................l.a.n.g.=.".".........n.a.m.e.=.".I.D.S._.T.O.O.L._.S.Y.S.T.E.M.R.E.G.C.L.E.A.N.".........t.i.p.=.".I.D.S._.T.O.O.L._.S.Y.S.T.E.M.R.E.G.C.L.E.A.N._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".0.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.9.a.5.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.4.f.".........a.d.m.i.n.t.o.o.l.=.".1.".......>.........<.i.n.s.t.a.l.l. ...........p.r.o.m.p.t.w.n.d.=.".0."...........t.y.p.e.=.".v.3.". ...........p.d.o.w.n.3.2.=.".h.t.t.p.:././.u.p.d.a.t.e...3.6.0.s.a.f.e...c.o.m./.v.3./.A.d.v.S.y.s.t.e.m.R.e.g.i.s.t.r.y.C.l.e.a.n...c.a.b.".........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\TraceClean.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):938
                                                                                                                                                                                                                          Entropy (8bit):3.5604493223205007
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QlL+xTiul0orJrZZywyVExRpFEflNO2w42Ny:y+xTEorJrinVwtsO2F2Ny
                                                                                                                                                                                                                          MD5:235902814550CAC9EB148900E0A83506
                                                                                                                                                                                                                          SHA1:8CF9F731F70DB097773AFCA05E824224F572AFDB
                                                                                                                                                                                                                          SHA-256:CF21C2BF7C67BC18F4C3AD72847AF2634F0B233A0C4D79BD3C20EDCB78AD259D
                                                                                                                                                                                                                          SHA-512:5FF5DC02CD8116198E51C876A1E8567DA7C43B0CD7A115192E5773DEED0C80FD6D71369623AA2A19A13B7D51A58913403E95C4E30A0263FD49517DED92DC9E98
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. . ..... .....i.d.=.".1.0.1.7.".........i.d.s.=.".T.r.a.c.e.C.l.e.a.n.".........g.r.o.u.p.=.".2.0.0.0.0.,.3.0.0.0.0.".........o.r.d.e.r.=.".2.3.0.".........s.h.o.w.=.".1.".................n.a.m.e.=.".I.D.S._.T.O.O.L._.T.R.A.C.E._.C.L.E.A.N.".........t.i.p.=.".I.D.S._.T.O.O.L._.T.R.A.C.E._.C.L.E.A.N._.T.I.P.".................b.e.t.a.=.".0.". .........n.e.w.=.".0.". .........p.r.e.m.i.u.m.=.".1.".........p.a.t.h.c.h.e.c.k.=.".0.".........i.c.o.n.p.a.t.h.=.".0.x.e.9.c.f.".........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.4.d.".........a.d.m.i.n.t.o.o.l.=.".1.".......>.........<.e.x.e. .t.y.p.e.=.".r.e.l.a.t.i.v.e.".........p.a.t.h.=.".T.r.a.c.e.C.l.e.a.n...e.x.e.".........a.r.g.=.".".........b.i.t.=."."........./.>.......<./.t.o.o.l.>.......<./.t.o.o.l._.l.i.s.t.>.....<./.r.o.o.t.>.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\config\tools\nodes\send.xml

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2212
                                                                                                                                                                                                                          Entropy (8bit):3.5584453549903943
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:y+xTs9W/DP53rPcVF0KMp3MpZrPcVF0khF2Ny:Bs9IDMdAxyy
                                                                                                                                                                                                                          MD5:BFD11F191D9DA1C9FD156613B56ED3CC
                                                                                                                                                                                                                          SHA1:2FA97C936549190620C7254A3A1CB24876A3E569
                                                                                                                                                                                                                          SHA-256:23FB1AFD207FD3836F80DCA8828604AEB4ED620CDD63D29CD459E5F2C80593C3
                                                                                                                                                                                                                          SHA-512:486D992594B6C632ECE06D93DB85DA00B96105654D943DE7CE30F1A8BBB722963F1430125F2434497F832A74D87751FE555F5BFD4F7B30626B233F39139DE5D7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.r.o.o.t. .v.e.r.=.".2.".>.......<.t.o.o.l._.l.i.s.t.>.........<.t.o.o.l. ...........i.d.=.".1.0.3.1."...........i.d.s.=.".3.6.0.S.e.n.d."...........g.r.o.u.p.=.".2.0.0.0.0."...........o.r.d.e.r.=.".1.0.3.3.0."...........s.h.o.w.=.".0.".....................n.a.m.e.=.".I.D.S._.3.6.0._.S.E.N.D."...........t.i.p.=.".I.D.S._.3.6.0._.S.E.N.D._.T.I.P.".....................b.e.t.a.=.".0.". ...........n.e.w.=.".0.". ...........p.r.e.m.i.u.m.=.".0."...........p.a.t.h.c.h.e.c.k.=.".0."..... . . . . . . . . . . . .f.r.e.e.=.".1."...........i.c.o.n.p.a.t.h.=.".0.x.e.a.6.1."...........i.c.o.n.b.g.p.a.t.h.=.".0.x.e.a.3.e."...........a.d.m.i.n.=.".0.".........>...........<.f.i.l.t.e.r. .t.y.p.e.=.".e.x.c.l.u.d.e.".>.............<.s.y.s. .v.e.r.=.".5...1."./.>.............<.s.y.s. .v.e.r.=.".5...2."./.>.............<.s.y.s. .v.e.r.=.".6...0."./.>...........<./.f.i.l.t.e.r.>...........<.i.n.s.t.a.l.l. .t.y.p.e.=.".s.e.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360FsFlt.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):553712
                                                                                                                                                                                                                          Entropy (8bit):6.484368962244133
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:DEhSm623kCPRrCDYi66qrtDF3Fg282r1tuRad+JuYk:AhSikMRBiDqXFO2GqQuT
                                                                                                                                                                                                                          MD5:B372E31C719A47B08FE4D377D5DF4BDE
                                                                                                                                                                                                                          SHA1:EA936FA64B8D11FA41825F07C2CEEB886804956C
                                                                                                                                                                                                                          SHA-256:8D21A430B38D74157F5D73F8DFD4D508C2FFF7F2945FA2987794F656B3ACB58C
                                                                                                                                                                                                                          SHA-512:FC2962127BB84AFF61239FEFC060C002EDB6560E11A5E7D2D0DD6D15A431200EB5AC988867988DDD84FD5DA241F6BC4A1319FFA83CC9CE7D5691E7E5C4170625
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................e./..l|..l|..l|..m|..l|.|.|..l|.|.|..l|.|.|..l|.|.|..l|.|.|..l|.|.|..l|Rich..l|........................PE..d.....oe..........".................0........................................@......i.......................................................t...P.... ..........H-... ..XR...0..l....................................................................................text............................... ..h.rdata..4...........................@..H.data............6...t..............@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360FsFlt_old.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):530696
                                                                                                                                                                                                                          Entropy (8bit):6.492912886668054
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:+2BPSuicLiwGHtC9VA6cF2wt9tu1FnnQp9X:vsSA6i2jVg9X
                                                                                                                                                                                                                          MD5:CD20D1DD4EAB42C47D1DED235F97329F
                                                                                                                                                                                                                          SHA1:A4A21345C840854E3798A008D244DB53217E42D7
                                                                                                                                                                                                                          SHA-256:4DF4E20BD4062E8971D85E8145B0B91B60922EC9F007702BA2B81D08029BA8E3
                                                                                                                                                                                                                          SHA-512:67CA599DDA7C69FB1220265E913B5B6456C36A67F148E7D58FB7C78E20AFAD92CA4E628EE9E484DE91235C898E855D96EDB93AD186099753317585FC20E3C01E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................3u;(w.U{w.U{w.U{w.T{U.U{~l.{p.U{~l.{r.U{~l.{..U{~l.{6.U{~l.{v.U{~l.{v.U{Richw.U{........PE..d...>kRc.........."............................................................................................................................P............@..\+......pV......l....x...............................................p...............................text...AR.......T.................. ..h.rdata..,....p.......Z..............@..H.data...X....0...6..................@....pdata..\+...@..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360FsFlt_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):553712
                                                                                                                                                                                                                          Entropy (8bit):6.484368962244133
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:DEhSm623kCPRrCDYi66qrtDF3Fg282r1tuRad+JuYk:AhSikMRBiDqXFO2GqQuT
                                                                                                                                                                                                                          MD5:B372E31C719A47B08FE4D377D5DF4BDE
                                                                                                                                                                                                                          SHA1:EA936FA64B8D11FA41825F07C2CEEB886804956C
                                                                                                                                                                                                                          SHA-256:8D21A430B38D74157F5D73F8DFD4D508C2FFF7F2945FA2987794F656B3ACB58C
                                                                                                                                                                                                                          SHA-512:FC2962127BB84AFF61239FEFC060C002EDB6560E11A5E7D2D0DD6D15A431200EB5AC988867988DDD84FD5DA241F6BC4A1319FFA83CC9CE7D5691E7E5C4170625
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................e./..l|..l|..l|..m|..l|.|.|..l|.|.|..l|.|.|..l|.|.|..l|.|.|..l|.|.|..l|Rich..l|........................PE..d.....oe..........".................0........................................@......i.......................................................t...P.... ..........H-... ..XR...0..l....................................................................................text............................... ..h.rdata..4...........................@..H.data............6...t..............@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360Quarant.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):493448
                                                                                                                                                                                                                          Entropy (8bit):6.655292011855481
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:Ak0euRcw3lPU2pDRkBC/+9oP18o9Ttn8NkRT/jc9w:HlWcw3lhXqCG9oP1J9Tt6kRT/jc9w
                                                                                                                                                                                                                          MD5:FCCAE501BE77C15D4E11343FFAD3ACA3
                                                                                                                                                                                                                          SHA1:C920A2B8226D03887176B8976DDBF25C35DCC13C
                                                                                                                                                                                                                          SHA-256:79553C8223596B5E5108370664E74AFC1F6C04EBCEACE1F49046535A90ECD7D3
                                                                                                                                                                                                                          SHA-512:8ED1F63B3A3B62757AD2DDD092E9787F2ACB72D44CF3A11ADCFA4677849901960AD198C6C26E88E2B0E7294A02606CDE4A95371E4A09AC43367BA9EAF84F17FA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................QC.....f@.....fV.:...fQ.......................f_.....fG.....LA......B.....fD....Rich...........PE..L.....C_...........!.....B...........x.......`............................................@.................................|........@...............P...6...P..(K..0d...............................#..@............`...............................text...b@.......B.................. ..`.rdata..Dd...`...f...F..............@..@.data....f.......6..................@....rsrc........@......................@..@.reloc...d...P...f..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360QuarantPlugin.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):269896
                                                                                                                                                                                                                          Entropy (8bit):6.6237259052549184
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:jA8c+bjRCNF/Hz2QsB8ufR1SIkllIailZbOmVjNCDh4TFco7gmzD:NbjRKRHz2DiufKIkllIai3O0jNMh4TrN
                                                                                                                                                                                                                          MD5:AF9C93176D78453523AFCCF44E895C1A
                                                                                                                                                                                                                          SHA1:AA9E2B49C2193D57492CF86135CD518F79BC104E
                                                                                                                                                                                                                          SHA-256:E4C0380830B553DF3991A96914CD527E3117BD5843D3CEC62B416C3FD8D4620D
                                                                                                                                                                                                                          SHA-512:9DDB742D55FB5B558D1DCA3D4061E7B18AD0DAD7B475B67585C4D35588D0EB8515FF76CD454EFDF0644D4565966C9A27860ECF6C05BC3A9774C06DA865CB28D8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J."&..Lu..Lu..Lu...u..Lu...u..Lu...uB.Lu)[!u..Lu)[7u..Lu..Mu.Lu...u&.Lu...u..Lu...u..Lu...u..Lu...u..LuRich..Lu................PE..L.....g[...........!................>........................................@............@.........................0...................................7.......)..@................................L..@............................................text............................... ..`.rdata..............................@..@.data....F......."...~..............@....rsrc...............................@..@.reloc..`=.......>..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\360netcfg.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):220792
                                                                                                                                                                                                                          Entropy (8bit):6.398281269637566
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:l6Vsw/g36H94PLULKUcmZnc7JesNK+XFzYDT:esw/g36HePQL9cmZi4FDT
                                                                                                                                                                                                                          MD5:25ED596561D66E0463824F12444AB3F3
                                                                                                                                                                                                                          SHA1:ED892CE2BDDD96EBB03DBC4BAE4394AAD061D6A7
                                                                                                                                                                                                                          SHA-256:07B44F39916B517E1AF296B10B7EFDCD3BA9196E877323BE2161A5DAB3162AC4
                                                                                                                                                                                                                          SHA-512:FF218DFD42154CD6C4CE4903B85B9D208ECCFCCE6C6CE4834C3D2C6F31FE27150D097508AC2F15E16648BC10379F75E8A98AB78A6B806CCC955C5477B3518D3C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[Q]..03..03..03..H...03..H..a03..H...03.8.^..03.8.H..03..02..03..H..U03..b...03..H...03.Rich.03.........................PE..L....m.U.....................2......~$....... ....@.......................................@.............................................R...........H.......p..8 ...#..............................0v..@............ ...............................text............................... ..`.rdata...~... ......................@..@.data...\e.......,..................@....rsrc....R.......T..................@..@.reloc...1...p...2..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\AVE\360KP.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):200672
                                                                                                                                                                                                                          Entropy (8bit):6.662964036868765
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:gfaNatzzafAMDWj18MDqu9pa9oGPMdLCLE++M7A4zeI/r:IaN6zmoF1dt9pa9bcLCLXEWeO
                                                                                                                                                                                                                          MD5:3302867FB8EF22605173966A1A98A34C
                                                                                                                                                                                                                          SHA1:DEE562EE40B01CF836DA6744315CDA3945A9972F
                                                                                                                                                                                                                          SHA-256:65E7F0CACE37E3CFE6B46F2059E639A46CBC72FDDC0552A0B8E729A0AA88B6D0
                                                                                                                                                                                                                          SHA-512:AF7525B93FD39665B3E78DB9CE57EFD1DD17BBE605B4F36EA26C1169CB949C5DA6FEECB5290377BC82FDDC62493D84EBC0998CDA7B44386C3821A4054A64B1F0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~..a-..a-..a-..-..a-..`-..a-..-..a-..-..a-..-..a-..-..a-..-..a-..-..a-..-..a-Rich..a-........PE..L...?.Nf...........!.....D.........."(.......`...............................P............@............................H......<.......................H)... ..8....b..................................@............`...............................text....B.......D.................. ..`.rdata...R...`...T...H..............@..@.data...(A..........................@....rsrc...............................@..@.reloc..:'... ...(..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\AVE\360KPBase.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):690656
                                                                                                                                                                                                                          Entropy (8bit):6.446250273525077
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:MS2H1xK43IzEwBR5TK/kEcmOpcZe7HEIOqHBtJNydWijRpD7:MS2WzbLK9iX7HEITBtJNydnjLP
                                                                                                                                                                                                                          MD5:2047ADBA6C54C695672560B8DD915B5E
                                                                                                                                                                                                                          SHA1:A60176E91FB5924F62BF72079BA825FD4057F865
                                                                                                                                                                                                                          SHA-256:823F58AF1D719CD0083D17880F9EA33FD7BAAD6B68EE99262ECEDDD0E9951C77
                                                                                                                                                                                                                          SHA-512:6502E9181C3CF2D9535B44DCA63ECE91402E0D420DBCA47B02A2551A02F9B2F603A2D052C6F22FCF4D543DA0BD5883CF452F4FAD967E86766DE62AE657516CE6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............Q..Q..Q..}Q..Q..kQA..Q..{Q..Q..QI..Q..lQ..Q..bQ..Q..zQ..Q..|Q..Q..yQ..QRich..Q........PE..L...O.Nf...........!.........|......]g..............................................0#....@....................................x.... ...............`..H)...0...Y..................................`<..@...............@............................text...I........................... ..`.rdata..{...........................@..@.data....Y.......0..................@....rsrc........ ......................@..@.reloc...u...0...v..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\AVE\AVEI.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):197864
                                                                                                                                                                                                                          Entropy (8bit):6.6239933874940276
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:fOxOHJqe+hV22rO+0dTpPPF7aONEQebxGVQl5gNB+IIIliBcI4P0i:uOIeq22C/1FhNEQ84VQlSJUBBxi
                                                                                                                                                                                                                          MD5:915407F35A4FF1A885B5C0016A2B9E9C
                                                                                                                                                                                                                          SHA1:D8A99B4B4EC6F8ADB7646681B1FA133F50366B20
                                                                                                                                                                                                                          SHA-256:826B4489DD0143F0111FCA286C550C40306D2D7DED26AD10EAF8C93EFF447AF0
                                                                                                                                                                                                                          SHA-512:7F506B114D1CF3A1C72BC221F26140CF5674A00505F49214D7CA1D982F57953568BDA9C78B4DBC37506BDD23538FEB4C5AC3BCE929A4E8A22ACC7AF34B5E99B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L0y..Q...Q...Q...)...Q...)..gQ...)..9Q...)...Q...Q..{Q...)...Q...)...Q.......Q...)...Q..Rich.Q..........PE..L...C.d...........!.....(..........4*.......@...............................0.......p....@.........................p.......`...<.......4...............P,...........A...............................q..@............@...............................text....'.......(.................. ..`.rdata..L^...@...`...,..............@..@.data....B..........................@....rsrc...4...........................@..@.reloc...'.......(..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\AVE\AVEngine.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1412840
                                                                                                                                                                                                                          Entropy (8bit):6.5067245057890615
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3+8mSuiCeZsmWYSDJ/3Mn2Z3z52WN6T2Sur26IRI:DEBDJ/V3oa0G
                                                                                                                                                                                                                          MD5:AC9768394CB1B6B46F3C91624EEBBBE6
                                                                                                                                                                                                                          SHA1:C86A89DDACF687157D4234E5EC3E00FD176C0176
                                                                                                                                                                                                                          SHA-256:E60EBFC7C03FAB3F2D6BA085BEAA321B30C6B53681044FBDBDBBAC126ED62D2F
                                                                                                                                                                                                                          SHA-512:F3DBF4F82A8342CAEF1E08983A5DB0814016D8597017C6364D5E11EFC92A90BE8B6B1D23C478C9A8077A6DBF1D586D87E04CE4A806D4385E901E7F358BBEE084
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........d.z.7.z.7.z.7O5!7.z.7.."7.z.7..37.z.7..47`z.7..$7.z.7.z.7jz.7..=7uz.7..%7.z.7.(#7.z.7..&7.z.7Rich.z.7................PE..L.....e...........!.................................................................#....@.........................@1.......$..P.......4............b..P,......X...................................8<..@...............,............................text............................... ..`.rdata..(r.......t..................@..@.data....i...@...2...(..............@....rsrc...4............Z..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPI.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251624
                                                                                                                                                                                                                          Entropy (8bit):6.64074199908149
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:Kc2b7tdR+40XFA2vZWTt0eE210vgiam93b8GkyEPBSLH4G62Wjl69oI5VqNmM53u:z2bZ+p1LvZsGn8M4PpB6GiVUf1c7Nsm
                                                                                                                                                                                                                          MD5:42E36CEA45FE07A9E7F9BBD1B60511DE
                                                                                                                                                                                                                          SHA1:7FA1E6BD83A606349E159CBF523BA0BBF47DB20A
                                                                                                                                                                                                                          SHA-256:E6243A7741708B911CC0C5233FBF1572309F372575C337116878A430740264DF
                                                                                                                                                                                                                          SHA-512:0ED13F6310D7BB337F8184069BAF0800A5CCF8B4DCFBD7800873EC641C0DE71E129D45D66FD47115B2D1C2EA56995B155A1D08D9B9BD0AAD33D1DDD97F35BDE1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......jxm..............V../...'a..>...'a..^...'a........^.,.....\./.....x.9.......&...'a..8...'a../...0K../...'a../...Rich....................PE..L....q'e...........!................J*....................................................@.........................@X..`...,A..........p...............P,......8!..P...............................X1..@............................................text............................... ..`.rdata...v.......x..................@..@.data....D...p.......X..............@....rsrc...p............p..............@..@.reloc.../.......0...x..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):198344
                                                                                                                                                                                                                          Entropy (8bit):6.769491555052745
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:obsd1Au3Cdwi2W11JSciFtvPPSJhEi5kNCx866FIPIWbS0uHinSkAP0gP0h:o+K+WXJSciFtv3SJyOxsFGEySH8Jh
                                                                                                                                                                                                                          MD5:B7B91B32156973711FDBA826E2FED780
                                                                                                                                                                                                                          SHA1:0CAAA4C4B12801EA1DCFBC9BB46B5CC49CF74C2D
                                                                                                                                                                                                                          SHA-256:2D7FA3AF97A50240DEC7540E4171772912D1DBB82259AC4ACF039818417CDE5D
                                                                                                                                                                                                                          SHA-512:8AD87C80012FE9645514DF956A22AEE79749FEAC87B199C4A89F030544A49BD5C51148DF02885A794D20056BEF6091947C3BB61DFE60BCABAD71E3969A249967
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$..........!...3R6K.P.j...igS.L%.....]l.p.Gu.y4LD......2.Q....:W....e.f{:...........G*.6.....<...&a.b.5....<../H.-......D9...SG..;8.aH.....*d.!......................................................................................................................................................................................................................................................2.Q.v.?.v.?.v.?.v.>..?...b.s.?...0.w.?...`.`.?...a.w.?...e.w.?.Richv.?.........................PE..L...l}*d.................j...X...............p..............................................................................L...<.......(...............0R......,!...r..............................h...@............p...............................text....U.......V.................. ..h.rdata..4....p.......\..............@..H.data................n..............@...INIT....P............r..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV64.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):227680
                                                                                                                                                                                                                          Entropy (8bit):6.184590541950732
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:Dbqf/1pMk8F3WKYqX2wd/wuNnQI3lKjSJYF24Bg9fTggiyrDynbsnP0q:Me3CWd/wuNnQIQjSJYF24i9EoIYMq
                                                                                                                                                                                                                          MD5:992DE18C7B0D80D7B8531B90C3910888
                                                                                                                                                                                                                          SHA1:173C5C2AFA64CE8B8D2243B5BAA5D4A77C996E17
                                                                                                                                                                                                                          SHA-256:EDDE2232716629C09EBBF6A5DDFE55FC8BC2EDEF91CCEDE9104B3186FFB170A0
                                                                                                                                                                                                                          SHA-512:98346C390D9B64360C70B7C5780EFB62E856F03E19D58FFF433461CF5A2D833FEA847267DB1B72CF4103E9270F56B11EC542B15FC46E4A01233B8327A6878936
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.............................................................................................................................................................................................................................................................................................................................................................................................................}@..}@..}@..|@].}@..@..}@..@..}@..@..}@..@..}@..@..}@..@..}@Rich..}@........................PE..d...$.5e..........".................d0..............................................c........................................................0..(....P..8.... .......&...R...`.......$............................................... ...............................text...~........................... ..h.rdata..L4... ...6..................@..H.data... ....`.......H..............@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV64_old.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):228616
                                                                                                                                                                                                                          Entropy (8bit):6.191336466254519
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:qKn23kbAa2OAQMDOPZ1CwJMuCmYoSjdLSKjSJYF24Bg9fTggif2VXei9uxO6P0M:lbjvXTCmYoSjNzjSJYF24i9ESN9B/M
                                                                                                                                                                                                                          MD5:92250774EB2F9DD1316FC5DCA5A1D375
                                                                                                                                                                                                                          SHA1:DF62DEAF0A9EACDD74B6AB1C03767A4CB7AF9221
                                                                                                                                                                                                                          SHA-256:6EDB05BC886E30ADBA4164CC852EB089630D936F106A5A29F4D30727F1A6535A
                                                                                                                                                                                                                          SHA-512:BF68A4955CC09D20380736BB78B16F15AC85A6BEB6AF5065A640D7545707F573A17A5AA0F6664A2B8F2CD7BF0CCEB186F885210C8A07FC5D185C030D01793FD1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.............................................................................................................................................................................................................................................................................................................................................................................................................}@..}@..}@..|@].}@..@..}@..@..}@..@..}@..@..}@..@..}@..@..}@Rich..}@........................PE..d....JBc..........".................d0...............................................^.......................................................0..(....P..8.... .......&..pV...`.......$............................................... ...............................text............................... ..h.rdata..L4... ...6..................@..H.data... ....`.......H..............@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV64_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):227680
                                                                                                                                                                                                                          Entropy (8bit):6.184590541950732
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:Dbqf/1pMk8F3WKYqX2wd/wuNnQI3lKjSJYF24Bg9fTggiyrDynbsnP0q:Me3CWd/wuNnQIQjSJYF24i9EoIYMq
                                                                                                                                                                                                                          MD5:992DE18C7B0D80D7B8531B90C3910888
                                                                                                                                                                                                                          SHA1:173C5C2AFA64CE8B8D2243B5BAA5D4A77C996E17
                                                                                                                                                                                                                          SHA-256:EDDE2232716629C09EBBF6A5DDFE55FC8BC2EDEF91CCEDE9104B3186FFB170A0
                                                                                                                                                                                                                          SHA-512:98346C390D9B64360C70B7C5780EFB62E856F03E19D58FFF433461CF5A2D833FEA847267DB1B72CF4103E9270F56B11EC542B15FC46E4A01233B8327A6878936
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.............................................................................................................................................................................................................................................................................................................................................................................................................}@..}@..}@..|@].}@..@..}@..@..}@..@..}@..@..}@..@..}@..@..}@Rich..}@........................PE..d...$.5e..........".................d0..............................................c........................................................0..(....P..8.... .......&...R...`.......$............................................... ...............................text...~........................... ..h.rdata..L4... ...6..................@..H.data... ....`.......H..............@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV_old.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):199432
                                                                                                                                                                                                                          Entropy (8bit):6.780578514965119
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:T/Fq1zuOKKtYy2+NQl1ScidH/oLnZsMK5vtbhk6a9wpIWb60spi/7y9uxki3uP08:TU/q+yl1ScidH/WnZ7EhU9Esj9O3L8
                                                                                                                                                                                                                          MD5:98EE79B8E82C1DA453C71A6F9380D128
                                                                                                                                                                                                                          SHA1:7E9178BAB13A14B4B5567994ADA35D13FDB2B1BE
                                                                                                                                                                                                                          SHA-256:DC346A2ACB7A340A3EBFEC2AC684254DEFB66F5485726D0EF32B51A3247FAB83
                                                                                                                                                                                                                          SHA-512:60B4B163A4579AF0E39F594B1FAFDFCA09CD7CB99C598CC708E841BE3AC13CA56D1C6C2A760119060F82191E26819E6028CA4BD76CC25008A476F6B24E11ACFC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.....................%EVU}.eXO.zz...C.<............Z..;..v..i=..w0.6.8..3..1...v#.bF...,.~...!. p..Z...G.....e...6..hpGmo..TJ.,....JBc........................................................................................................................................................................................................................................................2.Q.v.?.v.?.v.?.v.>..?...b.s.?...0.w.?...`.`.?...a.w.?...e.w.?.Richv.?.........................PE..L...iJBc.................j...X...............p.......................................8......................................L...<.......(...............pV......0!...r..............................h...@............p...............................text....U.......V.................. ..h.rdata..4....p.......\..............@..H.data................n..............@...INIT....P............r..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\BAPIDRV_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):198344
                                                                                                                                                                                                                          Entropy (8bit):6.769491555052745
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:obsd1Au3Cdwi2W11JSciFtvPPSJhEi5kNCx866FIPIWbS0uHinSkAP0gP0h:o+K+WXJSciFtv3SJyOxsFGEySH8Jh
                                                                                                                                                                                                                          MD5:B7B91B32156973711FDBA826E2FED780
                                                                                                                                                                                                                          SHA1:0CAAA4C4B12801EA1DCFBC9BB46B5CC49CF74C2D
                                                                                                                                                                                                                          SHA-256:2D7FA3AF97A50240DEC7540E4171772912D1DBB82259AC4ACF039818417CDE5D
                                                                                                                                                                                                                          SHA-512:8AD87C80012FE9645514DF956A22AEE79749FEAC87B199C4A89F030544A49BD5C51148DF02885A794D20056BEF6091947C3BB61DFE60BCABAD71E3969A249967
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$..........!...3R6K.P.j...igS.L%.....]l.p.Gu.y4LD......2.Q....:W....e.f{:...........G*.6.....<...&a.b.5....<../H.-......D9...SG..;8.aH.....*d.!......................................................................................................................................................................................................................................................2.Q.v.?.v.?.v.?.v.>..?...b.s.?...0.w.?...`.`.?...a.w.?...e.w.?.Richv.?.........................PE..L...l}*d.................j...X...............p..............................................................................L...<.......(...............0R......,!...r..............................h...@............p...............................text....U.......V.................. ..h.rdata..4....p.......\..............@..H.data................n..............@...INIT....P............r..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\CQhCltHttpW.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):452152
                                                                                                                                                                                                                          Entropy (8bit):6.664155166675439
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:ywZNAenpvU0TEnMlKSD4R0gmsd09d0eLgYx92Wl80TGfb9:fs0MgSmsd2d0eLbx92WlBTGfb9
                                                                                                                                                                                                                          MD5:2B3A3D08BDD2501CCC5385C88468DC40
                                                                                                                                                                                                                          SHA1:E64A2EF85075752621CFC6D962AE9638AD3AC250
                                                                                                                                                                                                                          SHA-256:ED39C051647522B3A3CDEA16CA71362F0E636661169B8102B31D020516845AA9
                                                                                                                                                                                                                          SHA-512:4BBD03B7AC900E15476C10AAECD8D15C9D6712A2EBC306D8989F2D10A41D6B2E803C4C678647A63AB05750EAA18C2AD3EAB70856A95CF96B4234CF547A2F32CE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................=.d.....g.....q.0....{....3........8....v......`.....f.....e.....c....Rich............PE..L...)..^...........!.................O....... .......................................=....@........................../.......!...........................;.......;..."..................................@............ ..t............................text............................... ..`.rdata..Y.... ......................@..@.data....U...@...$...&..............@....rsrc................J..............@..@.reloc...S.......T...T..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\CheckSM.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):291440
                                                                                                                                                                                                                          Entropy (8bit):7.890536854636499
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:kToNyL35aczZrfAcIBP1hFLsvLzWw79MzQ+fsF0J2Q96fDo/ga3FR3:k8Ny1aUZrM3uz/+fTpSyR3
                                                                                                                                                                                                                          MD5:2E7D37F34C3877417788A8B080398BD9
                                                                                                                                                                                                                          SHA1:1D0A2E606DDA2479F9C6DA57D99F56DF814CC902
                                                                                                                                                                                                                          SHA-256:C9BADC3EBFD485C87CD34144FAA72B5893FA541808A94491E714D616CAC238B5
                                                                                                                                                                                                                          SHA-512:8525ACCE821E29F3F001D4FFF1126AD73388A64B69F42F647C3E5612D0D10CAB4DC0D9A5CBD688AF766DC99A386F26925AD1D43F106447D167C5FC18FD354F93
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\X.F.9@..9@..9@..&K..9@..A...9@..A...9@.?.;..9@..9A..9@..A../9@..A...9@..k...9@..A...9@.Rich.9@.........................PE..L.....zV...........!.........x............... .......................................k...............................................................\..........l....................................................p..D............................text............................... ..`.rdata..uz... ......................@..@.data...............................@....wow0...U7...P...................... ....wow1...-L.......N..................`....reloc..l............R..............@..@.rsrc................T..............@..@................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\CheckSM.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):189040
                                                                                                                                                                                                                          Entropy (8bit):6.299785863365332
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:JPITtlxdh7MRmPHel44NPjLzPgbhP7q4vpf5Vt5MMpvfMRTT7fCpmA:JPoN6m14N7Lj6PG4v6MO0
                                                                                                                                                                                                                          MD5:229588C3F399615A6D25E442FB5AC431
                                                                                                                                                                                                                          SHA1:F3CDF748620B9DA5960E195637BBFCCA58F39948
                                                                                                                                                                                                                          SHA-256:CB26F2F14B0C15180014A6262A8599BD0D8E4A0EF44445EE360725DF3D18655E
                                                                                                                                                                                                                          SHA-512:21F9AB01231A2C090A5C2AE1873792670BBA90F735481011113978FEA18408BEDB091837EB2B52A4B9123CD7DF5A0B16656868EE060C0F67B5CCAD101903777E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........YG..7...7...7.......7.......7.......7...L...7...6...7.......7.......7.......7.Rich..7.........PE..L...vpaV.................h...^...................@..........................0............@.....................................P....@..............................................................8...@............................................text...Xf.......h.................. ..`.rdata...c.......d...l..............@..@.data...|D..........................@....rsrc........@......................@..@.reloc..n........ ..................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\Cloudsec3.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1903072
                                                                                                                                                                                                                          Entropy (8bit):6.527284675813955
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:BnmftR/Ps1RWP3OTNeTPAFm29bJDsMaY6TAqA2:sn3s1RMeq
                                                                                                                                                                                                                          MD5:D97A691CCEA6E2FC9B079CF351F5B4C3
                                                                                                                                                                                                                          SHA1:7B94F99A1B4F147C70DEC53F2D642733BB0E06E7
                                                                                                                                                                                                                          SHA-256:D85DE5A6FC9055B029BF9DD0135B6583EB66A29FB1CD957019565D101A19750C
                                                                                                                                                                                                                          SHA-512:908CF9EA89A025B7041D52BA318F1F8D05B71EF34FA86CA4037287FC3F293F4BE0308FF3B5836318AA172BBFC7E2C2694BE5C9325788B087D247965C1D78714C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......Ej..............h.......C......A.....@.....gc.......u.....Sc......Sc......Sc..1...b......b.......s1......s!.$..........y......b.....b......bM.......%.....b......Rich....................PE..L.....0f...........!.................................................................V....@.............................<.......T.......(r..............H)...@...B..0s..T............................s..@............................................text.............................. ..`.rdata..RF.......H..................@..@.data...$........8..................@....rsrc...(r.......t...&..............@..@.reloc...B...@...D..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DSFScan.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):448096
                                                                                                                                                                                                                          Entropy (8bit):6.529629695952041
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:F3RxZhBu6jIidvI2fTEa1vd/P406y9qdfEDbmxLBQQI+4PP:Fhy6jy27p1vNw0lqdfvxLWbZPP
                                                                                                                                                                                                                          MD5:F5D999EC032786CB850C22E220DFB6CD
                                                                                                                                                                                                                          SHA1:0955724D94D614FE6615B7E131DF345F4789410C
                                                                                                                                                                                                                          SHA-256:53D819A12805B37D7B5083145AF8B292D42E603C716D3A0F39F249E485E341CF
                                                                                                                                                                                                                          SHA-512:F521D19F4D2693F42B29D28FE94044AE3BB3290C762D03671D6EBFCC8F247354E61D875843BD00E18D20FBF820B4CB3323549FF8FD53F88F4C5A9ABC61808CC4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................j.T.....W.....A.~....K....]......(...]......F......P.....V....U.....S...Rich..........PE..L.....zZ...........!.........................0...........................................@..........................)......L...........p................5......H@...3.................................@............0...............................text............................... ..`.rdata..1....0......................@..@.data...hO...0..."..................@....rsrc...p............4..............@..@.reloc..Ha.......b...<..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):172776
                                                                                                                                                                                                                          Entropy (8bit):6.8418857975732195
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:voR1xiZeoCtm10ceRxq5i2f9I/BxAVwyms5OkAL8zP0X:vo/xioo6gUq5i21M3AVwjKwX
                                                                                                                                                                                                                          MD5:B550A890C56811D8FADB70590E529D28
                                                                                                                                                                                                                          SHA1:A76E4239D520F5E2E988D9E82757B15ED704673A
                                                                                                                                                                                                                          SHA-256:8A91B4CAE02EDDCC2E6534AAB05B51EC422273DBEF333FE7BCABED548207D13F
                                                                                                                                                                                                                          SHA-512:1826FF3E282B70B89618A7CDF8C0AB0F6B2536CCF7AEAA4B26861D550C13F4200CC92CAA94A0494951810843A511CD2B85C7B7928C468443D7FA15973BE2AAD5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$6B.JeB.JeB.JeK..er.JeK..eP.JeK..e,.JeeF1eM.JeB.Ke.JeK..eQ.JeK..eC.Je\..eC.JeK..eC.JeRichB.Je........................PE..L....r'e...........!................................................................K!....@.........................pH.......;.......................v..P,......X...p...............................h/..@...............$............................text...E........................... ..`.rdata..P...........................@..@.data...`E...P.......4..............@....rsrc................L..............@..@.reloc... ......."...R..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):151128
                                                                                                                                                                                                                          Entropy (8bit):7.081389180769429
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:Ll9eToqjHB2HXktWVFv5NBc5i91P73sPi5V63lxUR/9rS1905I:M2HXkQJ73h5V6HUR/9eM5I
                                                                                                                                                                                                                          MD5:98DF4E7708FA2FD92A01C89DDD043D5E
                                                                                                                                                                                                                          SHA1:0590C7F1C5A0807FA8259E13FB7EBAE42D3E4B4D
                                                                                                                                                                                                                          SHA-256:35035495A36F8537E2A5F56031277CD884DE557257B40B92BD39454877A264FB
                                                                                                                                                                                                                          SHA-512:AD96143BF7870FF59C94BD5BE0655EA65C2C779B46C5FCC3B4388D1D751A70F20AA3902850B87716F286422155DE508F913C79E759CA23E5F0A65A97C571E20F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$..........u.P.......LZ3.......?...~%....1............~......m...c!..Aa..D02....I.u\.vn.:....n0.J.*...~c..B,T.....?...&..YV.UK.a.;.d....**eb........................................................................................................................................................................................................................................................................Y.....<......:.......,......;......>....Rich...........PE..L....*eb.................|...................................................@......u...........................................P.......p................M... ..P.......................................@...............x............................text....h.......j.................. ..h.rdata...R.......T...p..............@..H.data...,...........................@...INIT................................ ...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk64_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182008
                                                                                                                                                                                                                          Entropy (8bit):6.692335990486374
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:kiRcMFyBrzkqHKhnrEXnGWZC5hP+qLyiukCtuVv2jM8GiEzJTn52fQhgP0:v1grlHMrE3GW45hLLEJtuVv2jM8G3QQJ
                                                                                                                                                                                                                          MD5:B498F27CA312DB96A0CBE6B7405B2027
                                                                                                                                                                                                                          SHA1:D35C9E5BCB3DF23855130B783EA80FEA8653A097
                                                                                                                                                                                                                          SHA-256:34257623C1C563ABF99085B4C483A672945BD6059009EB001266F003F315B356
                                                                                                                                                                                                                          SHA-512:42D6315047D76B43BD2187F45C2F68182FA2B0E803BE8989417E8637C1172391D00C0B3A9B6227852BD4D31A72A661A19E074E163EF04BA2E031B2B4DF942586
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................<..]...]...]...]..k]...%;..]...%=..]...%+..]...%!..]...%<..]...%9..]..Rich.]..........................PE..d....s'e..........".................dp..............................................Xp.......................................................p..<............`..4....t..`R......d...0...................................................(............................text...!........................... ..h.rdata...J.......L..................@..H.data...$/...0...*... ..............@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsArk_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):163008
                                                                                                                                                                                                                          Entropy (8bit):7.152991627562633
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:mf0Zxn4qjPB2HXksAJDb5XHcLHi1n73s7e5VKnFxw9uxOSWWP0pr:F12HXd+B7355VKXw9sWDB
                                                                                                                                                                                                                          MD5:3D35317F967464AA670A52D3D632CD32
                                                                                                                                                                                                                          SHA1:A3F562399308BE926071F745D13A321FA7278638
                                                                                                                                                                                                                          SHA-256:A22358CB2FB1AA334272DEAA24E2280425F9661862B46331CBDC786138EDE8BE
                                                                                                                                                                                                                          SHA-512:C397A0B28D8B9A574F310652FD848828A09CA63141241FC420E30ACED1088B6378B75991FCB383F9746B6E6E57911BB42658887535ECE4382C59F93F61E08034
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$..........a.....o.........._......a..q[.Dd/.8..M....X|W<.....9...u.>...Z..x.sYf.Z..\..^...&....!.....@vS....}.l..T..[a..<*H...u.W...s..Dc........................................................................................................................................................................................................................................................................Y.....<......:.......,......;......>....Rich...........PE..L...x.Dc.................|...................................................@.......+..........................................P.......p...............(|... ..T.......................................@...............x............................text....h.......j.................. ..h.rdata...R.......T...p..............@..H.data...,...........................@...INIT................................ ...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\DsSysRepair.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):474112
                                                                                                                                                                                                                          Entropy (8bit):6.372490373804743
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:oQvRX7kTciZCLIVNX2ANQ1lvTBN92Bd4o9TteyK2tp:oQ5r2NXxaF92Bd19Ttectp
                                                                                                                                                                                                                          MD5:F1A65810EA2DF9E3C5C679F621AD7A57
                                                                                                                                                                                                                          SHA1:72D2BF3479D568459BCE16F25725652019F7B9BE
                                                                                                                                                                                                                          SHA-256:6B4E5D939258DEC73F9D05BE29F94A569DAC58476A516A3AFA3CF4FA6595FED0
                                                                                                                                                                                                                          SHA-512:732EFEDB8269841412A87D55F9BEE68319F8B3669F75AE5F4F89CCA1B9F0256879F51073CF6A8FA2501633EFAC82B702A491A0F7313BF321DEE4C40D01A2ADAD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................o....l....p...e....e.........z......}.....k....m...n....h...Rich............................PE..L...?c.U...........!......................... ...............................P......o=....@.........................P...................@...............h7.......1..P#.............................. ...@............ ...............................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...@...........................@..@.reloc...V.......X..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\ImAVEng.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178800
                                                                                                                                                                                                                          Entropy (8bit):6.528461543487617
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:jiDIuq4NUov4bsm+mWQ0xss54dG+Mhr41qMNhhwZcc8eye5/CdRCC:j6Ab5ITktMhsJjMcFMuX
                                                                                                                                                                                                                          MD5:D4BD98AE66F506B4770250D1938E88EE
                                                                                                                                                                                                                          SHA1:0418D9A2CB2EB077A7D9F63171A30C751F4E0174
                                                                                                                                                                                                                          SHA-256:255370BBDF16CC8A82359EBCECC9D1052E20CD73A2E13C90A9F7225F9FEB66B9
                                                                                                                                                                                                                          SHA-512:3DAF23EFC2FDB8172B015ECECA50A5699F1B32DC74928C218AC0B83564FD301B5BFD6D4989429BC6B96F4F565ED3BEEAA07BBEECDDE9C1DAEA265016562A9BC6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4A..p .p .p .yXa.b .yXw.. .yXp.I .W.q .W.{ .p ... .yX~.h .yXf.q .nr`.q .yXe.q .Richp .................PE..L....$V...........!......................................................................@..........................b..U...@V..x...................................p................................?..@............................................text...W........................... ..`.rdata..eb.......d..................@..@.data....7...p.......X..............@....rsrc................r..............@..@.reloc...(.......*...x..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\MiniRame.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4929205
                                                                                                                                                                                                                          Entropy (8bit):7.746317439634946
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:98304:8n33YCEBpxshhJDzIGfp9bvP8AZYk0lh0G1vtGUtx:8n33vE3cvIsL8A/IhzLR
                                                                                                                                                                                                                          MD5:111A17B8ED53571845A67318927231D6
                                                                                                                                                                                                                          SHA1:7AA7776306978D2152A9AF13306A7C0B3EA3CA03
                                                                                                                                                                                                                          SHA-256:A8207439B9CC28FF790AF1A6A9C5208D355FE0346D52876965EE7F27FD818867
                                                                                                                                                                                                                          SHA-512:84CCDE69290E6DC7F0E92910FA8677FF7FC11533B2E27AA3545F9D142B30AA2B3069FC6F35FF3718A533E61852B1E6265F9139BEDF78C3527F4D765B8B5519C9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.*....-<..$?PO."...=P~.$*.&5`~.(...:Ir.9.$..=J.%OK^f.%...>P}..(...t....)M..........C...(8Afo%..'E2W....H.={_...3*.Ja......a. F.1.M^."...&.\\...5@:XZ.G..7A}Y)N.)E.]l.8../9mU.?,5.Fj..#.O.1.t.......3...4.z.H.$S..d....<)Nz..)....u..*QN.W..".#A.J..7..A?j."1...L].3L.6..ls.)$4..Qo.&...=.../.IT..v..!(B..n...C--^f.I.8.,a..(..5".a. .*JHn..9....d..*..<4.L.....?}h.F../3.j.=.L..^o... )9._.8.>.!Yt."1O/U.p...&."I\....2.R..'.D9.x.... .1WG.,...<.].I.F.#d.0... <S{......_....,9.~g.9,.0/]o........F..6.^h.<..8<.o.-..C3....%..!pu.*./T9.z...=..Wu..#.3.X\...N.'b.....9..[...$,,Yr...-$....@.=U.NH....:G.}.4.'5!l...07C@aq....D..Q...)#..4.+.Ir..+..$.go..../*h...1.R&[..-2......8..H$_....-.8uV...8...|....80.Q./...@U~.?....{K...5DCr..$./>J~w"..Q7.pa.8....eU...(..p. #.6.-...=..-..G.....&.c...%KJm....E.0.....>>*\.....26x..-.(.3lI.....7`S.<.=J6.b.&.!OL..$2.....H.5...F..$F,-+.{..O.-A.cv.*.5.%.c.....1..+..&</Bh.5..D7.t....HC^a.M.QN3{h...;D:uQ.C.I$.~.../.................H.zT.=..4.XX./....Vi....+ ...".-".gh.O..J..g.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\PopSoftEng.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):535040
                                                                                                                                                                                                                          Entropy (8bit):6.588159451317266
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:al0j1T8QjTSBQAmysi0/Tz++04exJ152XM9D+/83fDR3YbJsSP4ikwjV4W:al0jJ8QjTmZm++W+/8bGJsSP4rAb
                                                                                                                                                                                                                          MD5:7680876D732E1CC64DA70E32A977BA6D
                                                                                                                                                                                                                          SHA1:83A6BBE1C092B9775B5E77229D0A2A93055B71E3
                                                                                                                                                                                                                          SHA-256:E4CFB253EA4416642E10D43D41D561CCE517D6A6BDF0653FD2C15A533B7181B5
                                                                                                                                                                                                                          SHA-512:7EBAFB4DBCB0597FACF30D4F8958CB94E25E280781A6A1BC31BD932C92C01F16D56825D3FDDA019E25A72B11108B4094B7CCCD7F6FA7AD821114E95891ACF2AE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~H@\:)..:)..:)..3Q..")..3Q...)..${..>)..3Q..|)....C.9)....U.-)..:)/..)..3Q...)..3Q..;)..${..;)..:)..8)..3Q..;)..Rich:)..................PE..L....\...........!.....|...p......m&.......................................`............@.........................pw..N....f..........@...............h7.......D......................................@............................................text....{.......|.................. ..`.rdata..............................@..@.data....c.......$...h..............@....rsrc...@...........................@..@.reloc...[.......\..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\QVM\360AQVM.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):745584
                                                                                                                                                                                                                          Entropy (8bit):6.780975066501689
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:o+K4/Vs+dm2jOa3lwSg4ffYhKTGEaHStZBrn9fvIfVpd:o74BTlwP4EKTGxwZhn9noVpd
                                                                                                                                                                                                                          MD5:8E11328C15CB3B6BD56AEC12CB64643E
                                                                                                                                                                                                                          SHA1:C8B25536660BFFDCE039583D2C6B7EEAC385B3AA
                                                                                                                                                                                                                          SHA-256:E1F053D679F66B04C94A7271CC403060642FD7015840E42253CC7C78D8998BBC
                                                                                                                                                                                                                          SHA-512:BAB17AC6310174D65285A8EDB8712BE1584B53BA4DD2A90465A1D565D692B2D3570B4199F4AFA7F23DE9A201E00D1BDFE4B57CD58EBAC28E1E54018B5690476D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<OO.R.O.R.O.R.B...X.R.B...:.R.B...c.R.F...L.R.O.S...R.2...d.R.2...N.R.B...N.R.O...N.R.2...N.R.RichO.R.................PE..L...F.sV...........!................JT....................................................@.........................P...........(....0..8............J.......@...M.....8...........................(b..@............................................text............................... ..`.rdata..Pp.......r..................@..@.data...`.... ......................@....rsrc...8....0......................@..@.reloc...M...@...N..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\QVM\360QVM.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):844400
                                                                                                                                                                                                                          Entropy (8bit):6.528706813294289
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:Hgy52yLSsvsaUxkkSe9eT68NB6JmObwTCEM+XulMgIfYZUKhyyOtprorxAjLQTPw:D52WN6CCE6HIfOLI7t4WLWKtV
                                                                                                                                                                                                                          MD5:2B176FD7EAF84ACA245FF1CF3E5DD858
                                                                                                                                                                                                                          SHA1:7F235CC85CCFD66E7B0DC924A619781691D84B2D
                                                                                                                                                                                                                          SHA-256:DFB299E78B489974414FB70A9C5C8E5F2B1281C47573E49B356CBD0C04757ABB
                                                                                                                                                                                                                          SHA-512:39EC7B8DC0B3AE52730D42EB44FB6B6BF043EB86C911DD7AF706952167C11D6F021BED5C54EC835746FA5A071840EAC18CD1B0EABB4CA9EFBC7AC0A45480874E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x...x...x...u.R.X...u.l.;...u.m.....q...{...x.........h.......Q.y...u.V.y...x...y.....S.y...Richx...........................PE..L...`.yV...........!................7........................................ .......Y....@.....................................(............................... ...p...8............................P..@............................................text...H........................... ..`.rdata...0.......2..................@..@.data...(F...0...$..................@....rsrc................2..............@..@.reloc.. ............@..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\Qshieldz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):609790
                                                                                                                                                                                                                          Entropy (8bit):7.999680696512047
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:12288:YV6gvB49Z1TiKF9MDPvFASv1g7Y8rY04eGnEdCZfgY:YV6gITgvF/v27DY0TGnEd+oY
                                                                                                                                                                                                                          MD5:336954204A55488C436853AF35BAE6BA
                                                                                                                                                                                                                          SHA1:A65494404EC870F88C50BB2B812BB90878441BCD
                                                                                                                                                                                                                          SHA-256:E7E68E6D20F0D81B794CAFC0B0F6D776E0D9125FE3771D1641D58DEB3C90F124
                                                                                                                                                                                                                          SHA-512:EFDBD1015AF9D2C5EADBBCC6C817178BED2C57E5DCD3A9B7DC32ECC95332FF1201EF3B894901F0F9932A883ED23AF814C5970E6E4CD788807244A89360262B4C
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<................M....ZF.&............L................LLLD.j.LLLLLLa...~.h.x....V.)..1..!e..V.....<"../l.f...HQ..=.?..`....0......3..I...A.I.......t@....j.{1....)B}XtX!.;$.E..."..r..V&.ik..<l@^[...g.....si..[R.4K.Q.......7..X,.....d8.Y@..k.:...@.1....L...."....:..[.zW=.`........%........K..-^.........P....{.. ...)......I#.c.R.......9.q/..N(.V,5..#....pw.aa.<.28.l`...:4..Y..%.!..MG..7.../.f.....y.Zj._.}D....c.C+.M..7{R....3I'.79.2.~9..X.T.A...p.Q.....?...d.dt...!.*...%i.W....5y..^....&b.......Y..{..F[..<0..^O..G.....+.H....jn.71x.?p......B0..0.v.p:......(.M.. .(.^I.}>2R:..P.f.........4.].b...V...BB...-....b.f.=...L..w........=I...v...[.....7.e?.t=Y}...E..*.......,XDY*..ym...=......7b.Z%^...Wc.?..o......[....=..]-....}Cn.+.8YR1....[...+q.NYCq.\...up.....)..(_.15.K..Z..R....*...l....K.......4....p...|)g.Npn..6.........t.......h. ......hBmpg..b~8........8p.5..../.....L./.....o..b*G.n{.._a.l.h..D.{......QC....B,.t}.vVL.;..=:.jYS!.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\cloudcom2.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1538016
                                                                                                                                                                                                                          Entropy (8bit):6.557510632347848
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3MammxiwxUfnubILhJ59Z3Y2eSnPCHzlOlOvuvj799W1uvhEw9Ta4JqAhRvndcON:3TmmKiACHUS8t9TvhxTa4J7hRvndcOJ7
                                                                                                                                                                                                                          MD5:A847C7E47EAFFBC0F5DBFD5C60A11DD6
                                                                                                                                                                                                                          SHA1:ABB96149CDE600B9D4793B3FB7B94EE9D428775C
                                                                                                                                                                                                                          SHA-256:F6E07024B3B9785A39145543CF793AA507F9B1C27B10D347BBC0E143BDF03846
                                                                                                                                                                                                                          SHA-512:C05BCE5B37FE5F0F245C8EBEA86DC26A94F848EBFA776874D878920C3D4D30AD7AA2EDBEF995FEBAE8E392EE97D59DD7B2BD25C2572E7EECE31BAB9E5A5F06EC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$..........A.........P<"....P< .L...P<!.....z.....................s.............................P.............@.....t......t......A.......A......A.,.....D....A......Rich...........................PE..L...X..a...........!.....8...R...............P.......................................w....@.............................d...D...........(............8..H?..........p...T...............................@............P...............................text....6.......8.................. ..`.rdata..0....P.......<..............@..@.data...X........D..................@....rsrc...(............*..............@..@.reloc...............2..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\deepscan.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3058920
                                                                                                                                                                                                                          Entropy (8bit):5.867642822115554
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:MP94CXKbyu7KA6XqrhsoA6mWpRUkDbiqrKzV7nYw7MPxViM:MPtKbz2A6XQsoANWpNCg
                                                                                                                                                                                                                          MD5:1C24736AA5A744B2A2C1F3A2E7A79610
                                                                                                                                                                                                                          SHA1:9A967F60070C0D1457DF04F0F8EF0A63AC2F0EDD
                                                                                                                                                                                                                          SHA-256:F0029A69542B8CC0D28F84D14821723B00DC4B2895A68918FCA8B3483F03BA30
                                                                                                                                                                                                                          SHA-512:AF13D5F348E2108EA4C7FDBE070EC29692E2C25C11B8A1D078529101B2E75C7695573F8B3C757EB5C856BE48D38498C96CE323E1E7EA7496A9E7D611CB7D00DD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$............q...q...q..a.U..q..a.W.zq..a.V..q..)....q..K.c..q.......q.......q.......q..p....q..p....q....'..q....7..q...q..(p..@....q..}....q..}....q..}...6q..}....q..}.[..q...q3..q..}....q..Rich.q..........................PE..L.....=d...........!..... ...................0...............................0/......t/...@..........................!.......!.|.....&.8z..............P,...p-......I..T............................I..@............0...............................text............ .................. ..`.rdata...~...0.......$..............@..@.data....?....!.......!.............@....rsrc...8z....&..|...B&.............@..@.reloc.......p-.......,.............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsark64.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182008
                                                                                                                                                                                                                          Entropy (8bit):6.692335990486374
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:kiRcMFyBrzkqHKhnrEXnGWZC5hP+qLyiukCtuVv2jM8GiEzJTn52fQhgP0:v1grlHMrE3GW45hLLEJtuVv2jM8G3QQJ
                                                                                                                                                                                                                          MD5:B498F27CA312DB96A0CBE6B7405B2027
                                                                                                                                                                                                                          SHA1:D35C9E5BCB3DF23855130B783EA80FEA8653A097
                                                                                                                                                                                                                          SHA-256:34257623C1C563ABF99085B4C483A672945BD6059009EB001266F003F315B356
                                                                                                                                                                                                                          SHA-512:42D6315047D76B43BD2187F45C2F68182FA2B0E803BE8989417E8637C1172391D00C0B3A9B6227852BD4D31A72A661A19E074E163EF04BA2E031B2B4DF942586
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................<..]...]...]...]..k]...%;..]...%=..]...%+..]...%!..]...%<..]...%9..]..Rich.]..........................PE..d....s'e..........".................dp..............................................Xp.......................................................p..<............`..4....t..`R......d...0...................................................(............................text...!........................... ..h.rdata...J.......L..................@..H.data...$/...0...*... ..............@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsark64_old.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179288
                                                                                                                                                                                                                          Entropy (8bit):6.701764720061168
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:mmRc3wtFwZXzaPHYluEXnGWZC5hPxqLyNqk9tuY62V2di9AZs3vPBHfZh9r/390e:pnFeG+uE3GW45h4LjytuY62V2difx/9Z
                                                                                                                                                                                                                          MD5:A4C68AFA8FCA59190AB429AE631399FD
                                                                                                                                                                                                                          SHA1:2A4E3D62661E564468E4DFB99761DE099434E3E5
                                                                                                                                                                                                                          SHA-256:11BE27F2BA0AF548E2FD5AD7BAAA5AC3E10B928B0742680AB9F673D1EBF31521
                                                                                                                                                                                                                          SHA-512:2E3D5381649B8CB97179751963B572FF4F828D581B1E87DF0CEDF5ED51F76235DB0BA4E78087562AC6F9F02F805B9ECAFDBA53A1B4572363829211643D4F8FEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................<..]...]...]...]..k]...%;..]...%=..]...%+..]...%!..]...%<..]...%9..]..Rich.]..........................PE..d...'*eb..........".................dp.......................................................................................................p..<............`.......n...M......d...0...................................................(............................text............................... ..h.rdata...I.......J..................@..H.data...$/...0...*..................@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsark64_win10.cat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11130
                                                                                                                                                                                                                          Entropy (8bit):7.298113736772534
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:E9/kSyyNwB/uyKAUFWQFQpbbTseUfX01k9z3ATj1qU:kOpUFRe/6fR9zyj1qU
                                                                                                                                                                                                                          MD5:C8000AFF908A100760602D960CC1C20B
                                                                                                                                                                                                                          SHA1:7242BAF12B70287EF01A0452A542FF1ED2587C01
                                                                                                                                                                                                                          SHA-256:E0D5B3FD9E47E0E59D1165BA246558FB23ADA6CAE3B1CD335627AA2EB1D4D273
                                                                                                                                                                                                                          SHA-512:759C3BD80EEF89A86332D3D6357AC71A205B7C9950ACE5B2413B227904D91978C1076D3B56C14889B3DAF43EA3E415E684F812BA6F6107C56FA0EB06E0A132DD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:0.+v..*.H........+g0.+c...1.0...`.H.e......0.....+.....7......0...0...+.....7.....J......H.....X...231110061417Z0...+.....7.....0..P0.... Tm..O....H.J..U]s[.1 .A./5uN...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........d.s.a.r.k.6.4...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... Tm..O....H.J..U]s[.1 .A./5uN...0....UV.......).LzG.H.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........d.s.a.r.k.6.4...i.n.f...0.....nA.A.=.{v.Sk.xh..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........d.s.a.r.k.6.4...s.y.s...0.... .ZlXR.!x.y..d....\......6..?h.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........d.s.a.r.k.6.4...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .ZlXR.!x.y..d....\......6..?h..G0..C0J..+.....7

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsark_win10.cat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11225
                                                                                                                                                                                                                          Entropy (8bit):7.295035916768729
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vIgUOZtymbMsyKtFWQFgXEYKKWDKHjj3SX01k9z3AKLSOFvl:3FRR+Hj+R9z1/vl
                                                                                                                                                                                                                          MD5:D3F8BF82EAD0232CFD896A79A58834C7
                                                                                                                                                                                                                          SHA1:60DD4CDC57A2377B2B135042F9AB0C426179A552
                                                                                                                                                                                                                          SHA-256:155163127C51EB291A8CE3BE7A5BEF7F7E3BDF414BC77F75B480EB58DA2509F6
                                                                                                                                                                                                                          SHA-512:121AE9A1DD98EDFBBB874D5FBC9C2190ECE30902E4FE05F12D313CC16CC153E5A3954B8229EAAE6EE5D3EA360CB346BA6AE2BEA07DBFD7C4C15E04DBCC25519E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:0.+...*.H........+.0.+....1.0...`.H.e......0..b..+.....7.....S0..O0...+.....7.....+.y.V..L.........221018113132Z0...+.....7.....0..?0... rpX.WB.?.O.d......K..F.7O+..;..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........d.s.a.r.k...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... rpX.WB.?.O.d......K..F.7O+..;..0......+...Pd.nnC.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........d.s.a.r.k...i.n.f...0.......V..f...(...*/..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........d.s.a.r.k...s.y.s...0.... .x.w......l.Q.,.<.q."......Z..6W1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........d.s.a.r.k...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .x.w......l.Q.,.<.q."......Z..6W....0...0J..+.....7....<0:.&.Q.u.a.l

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dserror.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1016
                                                                                                                                                                                                                          Entropy (8bit):5.172976592813741
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q+ktNcI41fxWYuk1wkfv4M+vYLkRj6j4AvM5FBMcb1pb71:rkkI41ZJuk1wkoM+vmkRj6j4AvM5QchP
                                                                                                                                                                                                                          MD5:547E43B324B091777C4C47A9E71E8E6F
                                                                                                                                                                                                                          SHA1:BCFDC205752C6A4541191EE16FFD4A23BF51D9C4
                                                                                                                                                                                                                          SHA-256:20AB2E0D451859004503C220DCE94AB195B6AEDEE255AEBA6914135491994B4D
                                                                                                                                                                                                                          SHA-512:749DD3410FB5B03221FCA2FF26538D39DB6EF1C66F7FD3EDE5DBBEF9BA7946C93298BA6B5AC63ADBD32AB3697D9C0D4FFA4CA0CB91EC6CBF6FEA43349594D567
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.2.1.].....7.=..].S.mU..t........[.2.1._.c.].....1.=..O._.Q/.....2.=..O._1YWe....3.=..}./...........[.2.0.].....7.=..].S.mU..t........[.2.0._.c.].....1.=..O._.Q/.....2.=..O._1YWe....3.=..}./...........[.1._.c.].....2.=..f.c1YWe....3.=..P.N1YWe........[.1.].....8.=..P.N1YWe........[.6.].....1.0.0.1.=...eQ.u.k.c.c._.d1YWe....1.0.0.2.=.uR.^.u.k.c.cir.N1YWe....1.0.0.5.=..R.Y.S.c.cMOn.1YWe....1.0.0.6.=....R.\a..R.Y.S1YWe........[.2.].....4.=..R.Y.S.u.MOn..c.c._.d/.......5.=.uR.^.u.MOn..c.c._.d1YWe....6.=..R.Y.S.gb.._.d!jD}/.......7.=.uR.^.gb.._.d1YWe....8.=.uR.^.gb.GO.R1YWe....9.=.uR.^.Tek.N.N1YWe....1.0.0.1.=....Sd.s.c.o.n...d.a.t./.......1.0.0.2.=..R.Y.S._.d.Q/.........[.8.].....4.0.0.=...eQ;..Qh.E..R1YWe....4.0.1.=.uR.^.gb.GO.R1YWe....4.0.2.=.uR.^.gb.._.d1YWe....4.0.3.=.uR.^,g0W.gb.._.d1YWe....4.0.4.=....Sd.s.c.o.n...d.a.t./.......4.0.5.=..R.Y.S._.d.Q/.....4.0.6.=..R.Y.S..GR...fir.N1YWe....4.0.7.=....Sx.m.l.M.n.1YWe....4.0.8.=..R.Y.Sx.m.l.M.n.1YWe....5.0.0.=.uR.^...@S.\a.1YWe....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsmain.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):489440
                                                                                                                                                                                                                          Entropy (8bit):6.603462749290099
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:zZvV1xWNBlphQ3rwoGXDsCmysPkq24SNT1f04pBESKE9A:R3x+lpS7xEmysPkjvT1frrKE9A
                                                                                                                                                                                                                          MD5:F2B85341A241BC9A8249F467ED3B6473
                                                                                                                                                                                                                          SHA1:80F60BF52F0C35CCD975D8CB499B07F66801D2CD
                                                                                                                                                                                                                          SHA-256:DCFEDF6E12B086AC39022D75D3CBD9E1CC0000536B763A4CCB9EF7B20020DDCF
                                                                                                                                                                                                                          SHA-512:0675BEBDB0F02D0A8A98C2368B25C16465EA42FCFB43537461E904E6DC969780B2E0937C4122733E2D5A240DC3BB32906045C9868F4B2D43D061EBF9C66AC4AD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$......................M.......0.....................2]g.............0.......1........................aR.............#.......#..............&...............&.......b.......b...............#.......#.j.............#.......Rich....................PE..L...'.a.................:...................P....@..................................G....@................................. L..........l............8..H?...@...;......p...........................0...@............P...............................text...79.......:.................. ..`.rdata.......P.......>..............@..@.data....0...p...&...P..............@....rsrc...l............v..............@..@.reloc...;...@...<..................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsns.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2444
                                                                                                                                                                                                                          Entropy (8bit):7.89708180392044
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:RmU3+qvEQHcd+3doOH03oBvzXaJlprHOOwLe31v1062mDkHTgweMX4:RmmBP8YraoBaJHrpwLeFKi
                                                                                                                                                                                                                          MD5:4A77E3A95368DF0EE37A8C6CA97BCBFA
                                                                                                                                                                                                                          SHA1:923C61AB828B4AEF6BF439BCACA0B540B90B53A8
                                                                                                                                                                                                                          SHA-256:E65BC5A3A67D4F3DF1D02CC0C9EF8C35871FBC1E17B70087E94B37E33BFA8BC5
                                                                                                                                                                                                                          SHA-512:B3AB461ED32BA471B7D139AB4ADF296E1FB579AC6998241E43BCC6FEE1AEFDF3D3919A9330CE8B4A671B62294804042A2DF6ADA06E7D4E32FC1CED84934789F3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............P...,...._..<2..........N................NNNO..NNNNNNNPNF...UJt...}q+;m.I...U...D.../z$..km.c.........-S.I......qB..q..A.....}#Ov....9'K@B9.P....oPM6.w<.~...^....1N.1P....>...x.4.I.f...M.W|...n.../...Y. 4....z.B*..!.......B%(-...z.I.=K.l...!........D..9.a.z...+../(..g..`60t......m.:...r6.!...r..T.,.%.1.r..eM.....JU......z.X.9...*....c..'$....x(...D.HW..........G.&.d. ih..._.....WL...W.V.1S@....u......r..i,...3y....4...#U..m.e.p^g.p.(.!..V`...Ce..K...,...w.......,..1...`e\.o..~...../..s.B....v.^..C..._.....@....1B..ty...t..F....NP.....$........aN..5.....>a....O.r..X&..O.)..x...\....4..R../.....^E...T.|.W..o.2..E....9..ER......s....C..x<.fb.J.......[..x..~..\.AC.+I.1$..-.{.l%.......x.i..7..H...vt.sH....V.X.8....P.7..3\V?....y30.h`.........C.G.......A .Eq...W..v1...3.J.ik'z.9.4.....1...`.AY........a..6.lg=.q../...Z.U......N....4G.@g...#.].9f...?....Z-..(.kw...P.....B.......F8K..6B\]>.ar....Q.t..Ux0.*aW$.]....8s....`.E

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60403
                                                                                                                                                                                                                          Entropy (8bit):5.392847591907253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:vAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAA:JM4A6UAHRHF4aImg
                                                                                                                                                                                                                          MD5:504461531300EFD4F029C41A83F8DF1D
                                                                                                                                                                                                                          SHA1:2466E76730121D154C913F76941B7F42EE73C7AE
                                                                                                                                                                                                                          SHA-256:4649EEDC3BAFD98C562D4D1710F44DE19E8E93E3638BC1566E1DA63D90CB04AD
                                                                                                                                                                                                                          SHA-512:F7DD16173120DBFE2DABEAB0C171D7D5868FD3107F13C2967183582FD23FD96C7EECA8107463A4084AD9F8560CD6447C35DC18B331FD3F748521518AC8E46632
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<.......................................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dswc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):51130
                                                                                                                                                                                                                          Entropy (8bit):3.077548643445156
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:e/XI3UFJDWYYVw0dDcY8GSB2fWl0ZCPhs6MvUT5OWuEJiABUmQ5Ge2rC:eEUFJq9w6ONBfFKs4REJiAjQ5GlrC
                                                                                                                                                                                                                          MD5:E2EE95891D4F2E7BD852B66CE425895E
                                                                                                                                                                                                                          SHA1:1195C1F54B50E90EF6F2520FDB0856139905623B
                                                                                                                                                                                                                          SHA-256:1F154F51D28689F172B196E4D7C6C5DD4EBA34DA65D7CEA6FB3F4B959854EAB5
                                                                                                                                                                                                                          SHA-512:288F1AF25D5930375947A7C9B03885CD4651A74267AB56686F1D55C6F106B0253D7A7CFAED04996A5FC011B7708C470468B1EB13A28FC06877797D73504305EF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<.......h.......~....................................bRbRdR7R3RbRbR1R6RdR7RfRaRjR7R1R1RjRcR7R3R`R6R`R0RfRbRbR0R4ReR3ReR0ReR6R0R3R`RdR_RXRbRbR7RkRkRbR1R3R1R0RgRbRaR`R`RbRgRkRgRcR0RcR4RcRcReRdRkR3R4ReR`RbR3RaR`RjRbRcR3R_RXRbRcRdRjRkReR7RcR3RbR0RjR4R`R1RaR0RcRaRfRdRdRgR1R`RbR3ReR`ReR0ReR3RcRgRjR7R`RjR4R_RXRbRcRdR1RjR3R`ReR`RdR4RbRjR`R4R`ReRfRjR4R3R7RkRfRjR4R1RkRaR3R6RjReR1R7R4RdR`RfRaR_RXRbRcR6R3R3RjRjR0R0R`RgR7RaR7RaR7RkRbRaReRbR3RdR6R7RgRjRaR4R7RaRdR1R0R`RaR`RkRdRkR_RXRbRcR6R1R7RfRjR4RkRdR6R6R1RkRaRgRjR4RdRgRkR3R1R`R7RkR3RgR7R3RkR7ReRgRaRkRdRgR0RjR_RXRbRcR4R3R4RfRkR`R4R7R`RaRgR4RbR0R0R6RkR4ReRjRfR4RbR6R3RgRcRbRjR4R3RaRgRkR0R1R1R0R_RXRbR`RfR6RgRcR0R3R6R6RfRjR3RbRkR3RcRcRjReRdR7RfR4R`R7RfR0RbRbR1R3RfRfR4RfRfReR4RjR_RXRbR`ReR`RdRjR`RkRaR7RgR4RgR6RcReR3R3R3RfR0RaR1RaR7RdRaRdRcR7RcR4RkR`RgReRgR7R3R3R_RXRbR`RkRcR`RjR4RfR1R`R6RaRdRdRdR1RcR1RbR`RdR3RdRdRjR0R0RkRfReRbRfR7R6RjR1RgRjRkRgR_RXRbR`R4R3R4RaR7R`RkRcRfRaRgRfRdRjRdRbReRjRgReRdRkRfR6R4RgR7RfRgR0RdRjRjRgRcRjRdRjR_RXRbRaRfR7RjRaR3RbR

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dsws.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):736672
                                                                                                                                                                                                                          Entropy (8bit):3.8348888749389785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:C7wKlzqO/l3QdtKJ7DhJIxVA4lJC9nq5hjtCIffY5RdZZiUGVFF7eHzt8/356iHH:C7wKlzqO/l3QdtKJ7DhJIxVA4lJC9nqd
                                                                                                                                                                                                                          MD5:BAF4457E25370B363CFFC7BAD08F564C
                                                                                                                                                                                                                          SHA1:738F6CA6642838C8CC232B173D7A2EAA4B354EA4
                                                                                                                                                                                                                          SHA-256:966CC1A9171DE9FA8CD07E8D2E1B023ACA7A833FF670B314A16080C81053C4E0
                                                                                                                                                                                                                          SHA-512:8CE2A3703B7DF40952C760036DC7C2D0C3E4F9D4AAAD69D3BA65D28A65201BA6C797D81535C8EE5EBA0EAA226C89AA470B291E3EFB8A4A13EFE72223EE7B01FA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<.......h...I..fd=......................X..............nL.L.L.L.LlL.L.L.LnLlL.L.L.L.LFLnL.L$L-L#L?LlL.L#L*L8L;L-L>L)LnLlL.L8L(LFLnL.L.L.L.L.L.L.LaL.L.L.L.LnLlL.L.L.L.L.L.L.L.L.L.L.L.LlL.L.L.L.L.L.L.LlL.LlH.L.L.L.L.LlL.L.L.L.L.LFLnL.L.L.L.L.LlL.L.L.L.LnLlL.L.L.LFLnL.L.L.L%L/L>L#L)L L)L/L8L>L#L"L%L/L?LlL.L>L LnLFLdL.L.L.L.L.L.L.L.L.L.L.L.L.LlL.L.L.LlL.L.L.L.LeLlL.L!L-L>L8LlL.L#L9L"L(LlL.L)L/L$L"L#L L#L+L5LFLbL.L.L.LFLbL.L.L.LlL.L.L.LFLbL.L.L.LlL.L#L9L"L(L-L8L%L#L"LFLbL.L.L.LlL.L-L"L#LlL.L>L-L!L)L;L#L>L'LlLdLbL.L.L.LlL.L#L9L"L(L-L8L%L#L"LeLFL}LlL!L-L LlL}LlL.L#L*L8L;L-L>L)LlL.L!L.L.LFL}LlL!L-L LlL}LlL.L#L*L8L;L-L>L)LlL.L!L.L.LlLaLlL.L L-L8L/L-L?L8LFL}LjL}LlL.L-L%L LlLjLlL.L)L(L%L-LlL.L!L.L.LFL}LaL-L.L/LbL"L)L8LFL}L|LlL.L%L8LlL.L.LlL.L%L!L%L8L)L(LFL}L|L}L.L.LlL.L-L.L?LlL.L.L.LFL}L|L}L.L.LlL.L.L.L.LlL.L.L.LFL}L|L}L.L.LlL.L.L.L.L.L.L.LFL}L|L.L%L8LlL.L.LlL.L%L!L%L8L)L(LFL}L}LlL.L.L.LlL.L.L.L.L.L.L.LlL.LlL.LFL}L}LlL.L%L8LlL?L8L9L(L%L#L?LlL.LbL.LbLFL}L}LlL.L%L8LlL?L8L9L(L%L#L?LlL?LbL-LbLFL

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\dswtb.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):720644
                                                                                                                                                                                                                          Entropy (8bit):5.695991669975846
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:jhnWmFVTKWrwyPsFuoQ73YrgwdBw4N1gqWSO1hSunOvvhE1NKDML21YP:NnWm39kFKop/bN1G9nEEyrqP
                                                                                                                                                                                                                          MD5:2E73D6D77CDA5D3A2D55B63B1C5FE9C8
                                                                                                                                                                                                                          SHA1:ACE38D21B30275E72A5E0CC0DA464FD1BADED812
                                                                                                                                                                                                                          SHA-256:51D97C5DC97A4FC6505EB1AC0AC6FCFB2FDAC97CD0189D1F57EDAE8B2A325B11
                                                                                                                                                                                                                          SHA-512:150DD61E35C1AA8EA542D4B29218158C9228ECB49154559131F12CD26D1F00F886479C84388C75E6FC22ABE5F55A953ECB5368BEA4F4A6DD7F0DEA8AE3B70DC6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:Q3ER........1N..............uIHOQIHOQIHOC....$...cd.R].QIHOQIHOuIHOQIHOQIHOD...0g..?Gt(.QIHOQIHOuIHOQIHOQIHOC...T ...+.T.9mQIHOQIHOuIHOQIHOQIHOD.;'O.fJ.!...'.rQIHOQIHOuIHOQIHOQIHOBo........-@..QIHOQIHOuIHOQIHOQIHOBx..`YF.g.,S...QIHOQIHOuIHOQIHOQIHOBG..E.j~.o.,.F..QIHOQIHOuIHOQIHOQIHOD..k_$..^..x.QIHOQIHOuIHOQIHOQIHOC..B..kk.q..w...QIHOQIHOuIHOQIHOQIHOD.N.n}....F}-.D.QIHOQIHOuIHOQIHOQIHOBo..GX...H.u..v:QIHOQIHOuIHOQIHOQIHOD..F../.W.2S.P.8QIHOQIHOuIHOQIHOQIHOB.>. I.Y_H.9{.YQQIHOQIHOuIHOQIHOQIHOH.....@.b...C..QIHOQIHOuIHOQIHOQIHOHv....K.41.}..QIHOQIHOuIHOQIHOQIHOG..p...f'w..IQ5QIHOQIHOuIHOQIHOQIHOH_]`.F..........QIHOQIHOuIHOQIHOQIHOH.._.v..x..m../.QIHOQIHOuIHOQIHOQIHOH.3.w.~ ^...Z..lQIHOQIHOuIHOQIHOQIHOB.|...0.N..M....QIHOQIHOuIHOQIHOQIHOH.Q...M.D.L.....QIHOQIHOuIHOQIHOQIHOH...B....?...z.WQIHOQIHOuIHOQIHOQIHOD....@Yf..a..DoQIHOQIHOuIHOQIHOQIHOB.D..wW.8|....q!QIHOQIHOuIHOQIHOQIHOI..m...5......!.QIHOQIHOuIHOQIHOQIHOG.j...A.4ab..kQIHOQIHOuIHOQIHOQIHOH.gC.5`...Zr...QIHOQIHO

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\heavygate.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):542816
                                                                                                                                                                                                                          Entropy (8bit):6.786863646001123
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:CX/IloUkT7i5bE6R3+Xpu5wpz9scrROuWPFgR6d09W8:s/I6Ukvi5Q6R3upu5gzehLOH9n
                                                                                                                                                                                                                          MD5:05CA1B329225C764141C57D03CFBF26B
                                                                                                                                                                                                                          SHA1:54B1829DA74A6E75F5E8C040F6C6734F562817FE
                                                                                                                                                                                                                          SHA-256:48576B671BD975E9EA9CC40E6C9AB1FC2C4AE5114EC59442086291D1C674C7D8
                                                                                                                                                                                                                          SHA-512:D0606401F04C36D646C93C9F20C2561FB4137C949636860FE3416179F22CE425E323E9D0B3E9A2B6851187043DBC846B72E3116EDBBF72846BC2254829D327F3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................^.....O....|...........Y......H.....N....M.....K...Rich..........................PE..L.....iZ...........!.........2.......I.......................................P.......7....@................................|...(.......L................5......`,......................................@............................................text...d........................... ..`.rdata..............................@..@.data...|/....... ..................@....rsrc...L...........................@..@.reloc...1.......2..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\jcloudscan.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1241992
                                                                                                                                                                                                                          Entropy (8bit):6.738498217782349
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:oAtKrN1SMJW20gEwXf0msTxs32ykQjZjf4PBnO4xaThiMCoK9hs:oAtONQMJWDgEwvRWsf1z4IThiMCod
                                                                                                                                                                                                                          MD5:4C6A70443DA0C8A40B2693E2DF0C5998
                                                                                                                                                                                                                          SHA1:21CE7FA61C08F657A7C184E7449FD00D37B349C3
                                                                                                                                                                                                                          SHA-256:E0AB60C64FDB1E15BAD094F0FCDA6170872FC132556769FD64A1AB939FA79CF9
                                                                                                                                                                                                                          SHA-512:6A23090A95DF403ABDB7FB564A9159D6E5F954D04F7FF8E1F35DCAE44D1CD15F52223FD3E798385271B419311C74EFE625B0D9A8FB8DF77B7809E635D4C90058
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`..[$...$...$...:...)...:.8.....:.?. .....-. ...-...:...-.8.....-.?.n....Y..+...$.......-.1.B...-.).%...:./.%...-.*.%...Rich$...................PE..L......^...........!................e........ ...............................@......hY....@.........................................@...................6...P......#............................................... ..h............................text............................... ..`.rdata....... ......................@..@.data............D..................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\lcrd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):26060
                                                                                                                                                                                                                          Entropy (8bit):7.982278123322995
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:p2Vhz8to7VAJMHkfs0QNos2/W6R1Q/o8rgrRPZ:p2l8t4qgisOQw+Le
                                                                                                                                                                                                                          MD5:DE1C87C3D251882DB198419BDAA4749B
                                                                                                                                                                                                                          SHA1:4AD2A4241889D1DB12DA22404AC370EFFAC3CD1A
                                                                                                                                                                                                                          SHA-256:3B8BE851F1702D5E23DDFE3A396BDACCF17467D70D54E8396E0EDA380C54CD42
                                                                                                                                                                                                                          SHA-512:166958718658F34EB633FC6D6E7D1E4460EC59DCC64F9A16F5F78F0AC9FFF8ECAB5BD0C969C050941DA59F811BEFBA14D02464CF31AA883112ADAD7F96BE3AD9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...0...0...1.0.0.1................................................$................................................................l.c.r.d...s.i.g.n.................................................................................................................$8.....&.........:..Q..c.i-....'..~....].HNdw@.5...k.........2....Y.b.Q..f........*h_...(.Bg........?..@yR.:.....r.....$....;...O.FV`i<..ij..._6..)+,Z..jY.yv..a.....q.]$.]T.BOrWw.g..".Yq.....k_....D.......G!%....n]`......C<..>.S..d.....<..{x.H.}.....`u..~._=.b.......[.T.;.g0.z.Bdi.'.........39w...0:..h,#.X.Q.......\..1:g.C..2Q.#..{}...\........h0..Q.9....cV..Es{.9\..|....'9.C..UP@C....>.$].H<{.....m?_$......,0[..g...oX..x......!...(.S.....1uO..kp6......C...qR.../....k........NF3g2....0r...>o..k.i._13=.I...k.g.W..IQ....-..@...>H......UM|.F.Z.@"..n./..M..h.z2.......(........O...T....(..].g~..S.....F..Y-....g.4......B._.T....".N..K..;...p(.5%.C.\.<y.U......9.T..n..4&.z

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\lsv.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):91852
                                                                                                                                                                                                                          Entropy (8bit):7.996968353810659
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1536:wFkyesmgJqNEwgMTb4rcgXXk66GNrJc+MCYcH8d3zrCRLFL+huk9zN8:DthNEVMv4Aok67UXqHhtd+hB1N8
                                                                                                                                                                                                                          MD5:BA2A4A1CA63033B4B5E6B3C3BBC9DC3F
                                                                                                                                                                                                                          SHA1:306EF0915CFB3F481AF6F981B16E5B3C18B2D810
                                                                                                                                                                                                                          SHA-256:C0A004A1F8B83FB5AE2F5358705C98C62B70AC03CAA396B713B59FEDC41EC42D
                                                                                                                                                                                                                          SHA-512:E22EFFD871C945731B4D0AE24936B6C2FA6B867B606F43C182544A05B9CE9619100FDACB2E4510790D7C11CE50069268472373E767854A055555FA82131EFA00
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...0...0...1.0.0.1..............................................".0................................................................l.s.v...s.i.g.n.....................................................................................................................=..U.|..;M...q.%z).....}.!iA..S..5..nz.(.[.2\.....E..q..(c....&hW./.....#....Z...E.z......%GVr..xW..B....Z..G....>..=".......3..@..N.(...g...w.).u..>.....Q..K...3...?.&.[..6.w=$....h7.>...9l0.!...=.B........u.....\e\..^.......IR....`v#.,..T......n)*...#...gfPLi.i.S.......2.....%..[...:..n.A"...s~44..U).b.h.\..>[.Ib`..O.f=......'...fp*c...-.....{L<.t...d.k...~...%...=)..`..OD......n....._.| ..EK[..v..H..I<f...2.......ZR."6.`W=.LfJ.].4v..$...l.g......E]w.(9...;.P.o..3.D4../f.".......dC..q..^.-......;_3M.;..fG.XF.Z..H..1.O.J.<.\..+.......Ha.......l.qtI.AC.....[/.g&...e".4..61.....-....7r....,.Kq...:R.hN...~.......2.w.....)...^3.Z7T0..xJ.....lk..[#.=..<..............&..B.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\MacroDef.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6864
                                                                                                                                                                                                                          Entropy (8bit):7.9740967057830145
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:H3Scxqw8cZIgaqQEcx/kwojmI3v1rb5sNNhQsaqhJjfV:XHkBcy8JcqwoFrb5sfhNaApV
                                                                                                                                                                                                                          MD5:9FA1BFDE0B3FDBC8B3386A674B74FABD
                                                                                                                                                                                                                          SHA1:7D14B0B25DEBCB2F360D8613297250D6FF54F4D2
                                                                                                                                                                                                                          SHA-256:B1E6CB63CE3EFE0D929508EAAE7D7F54FA1F2586E804265DF578FD55B1EE4890
                                                                                                                                                                                                                          SHA-512:E67BA49C5F38117DB727D5D0ADE8EA5799272753F7ECAA3BE2AD49CF60E1154E8B0D9D0F9EFD504E3D8860CDC31C27DDE7435762D770921C10D924631DB61C83
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..z.............jT.P..,g...b.#.=.K.CL....C.4wG.w....v.p.p.7.}+d5[.p.....n..3S_I.^`2 ......Wo.y/.Sb.4.`)..j..S}......<.h.Hk..r....A..V).....B..l..8....T.O...9.."E....._.."....2...A..b.....8.P_Q...b.CG.l.a%~(...:......-.L..'.5...6h.R.D......M&......5~^/.}{s.z`.|.j.[..TDKO....E......BP.h..E.7..`.l6..c.T....0.&..K..3..?....w....."q..xp..`c..........._~.7....Ow...[H.=..~..|.$b....G....g. ri._e.z../..z.5.|1...:.V...u\..et...S....+..@3.9.y....f....wk5.ybE%_L.pR.V.....U..|.Hd...&`...YB.E.Y.....,.&.#M.......+._3...)...U...jG.[......w.i4.Z....._{2g.m_Q|.U...@.......Q.I.q....n...e.4M.1>p<.....B`.......I.ia..X.t.......u....R.w..40.V.I..........{.\h........z......C...b.3.a.l.vcd.TZ.u......U..1.4g....W.2.S..}..p.6..WL......>.f...>[]..O..V.....=.....=%..)C......2..5.Q@......l.[.|.<v.r.....e.m..N..F.x..S(..6......c......JS...........].8^~<&[.Vg.x.@)T......y\.L...X<......I.w.1.P.{....]L...b| C..5oL....?.0.Ed.].&.......&..."&...tr...k.-.Z....=...$.;.9bi

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\PHPEX.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):475368
                                                                                                                                                                                                                          Entropy (8bit):6.61830865420221
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:+71dkfEIswIceUS6DK7blxdv7nl3MZAtt/gr3t2Y4ngTNIc11GLEK:CCjsBceUSVbZDl3MZm/gQbgTec114
                                                                                                                                                                                                                          MD5:86CC0B01D9955019FA8FCF326E4474DC
                                                                                                                                                                                                                          SHA1:61009865C4D5DDF242546A1FF9673ABA4C59D48B
                                                                                                                                                                                                                          SHA-256:61193CEC93CEF96053B53977B45825D7DAEBB21D84BF1A327D3A5628D1D94419
                                                                                                                                                                                                                          SHA-512:A56A541B39DA28E6BBDE6AE049F7E62E71D91DA83929CEE283C1BB02CF48F8541AE27ABC512E6EB4A3E26B23ED858975ACAF2C238C925B53ED9C42B73359245A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6;.brZl1rZl1rZl1.(o0xZl1.(i0.Zl1.(h0fZl1."h0}Zl1."o0eZl1."i0TZl1.(m0qZl1rZm1.Zl14 e0uZl14 l0sZl14 .1sZl1rZ.1sZl14 n0sZl1RichrZl1........................PE..L....Te...........!... .B...................`...............................P......*.....@..........................>..H....?..(.......................P,.......;......p...........................X...@............`...............................text....A.......B.................. ..`.rdata.......`.......F..............@..@.data.......P.......,..............@....rsrc...............................@..@.reloc...;.......<..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\patt.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1082064
                                                                                                                                                                                                                          Entropy (8bit):7.999742210595719
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:24576:3d+tNku2Rvqwz3lQZj0rdivF9PKhgDlbBus:N+7kVRVO4BivvPKWDms
                                                                                                                                                                                                                          MD5:74E2664A0982B244C301369C543B847F
                                                                                                                                                                                                                          SHA1:9E715E3706EFF62ED26A009DC0E8716F13DB14C1
                                                                                                                                                                                                                          SHA-256:C209F06C521913F3266FE326EE8AC73A54F67052D84D8F317D86DB5B63EDA71F
                                                                                                                                                                                                                          SHA-512:760A82ACE557BB032CF312BF6427CC5D404D733F6597567016957EB5BDC24EE0DB5C711C8FB4C23E9526136A460AAEA0854799B32BAD26B0EAFEEB571CBB31EC
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..z..............S.......a....p...r..<...q-.SPG.C...g..t.ucPs....NW@..{h65....r.i..9..t=..I.....M_..?......n.G.;..z..tv.(..X....`......'U..<oH.t..8......V~..?s..$....=.....;b..W[>3.-..C4.G...SV:....`..A..."b&..0l.^p..i.JlP.kP......;H....%..h!..q..%?...$8.?.e.......JtI/...G....R.AW..i..j .o....L.bk.t...b2..U.a....S._N."96.a5..{#l......#|...|.U.......5..."9(......WlHs...q..sl.i.T.L.Z.........&O.t,.....BjL`E._.@4G.....7....f.t...X.5XO.A..H..).2..4]...]..Tf.R......oY;...7.D.8.Qw.F...b.w.}...Yo....S.Y'w........Ud6....U.gQ..........L.:..-B(.....O.].....K....?....,.N..'..)..G.{f*....@.8.*.s...m.! ...|1....9X.a0 .R!..:8.6$......:.....&...g....n...+.a=T.,c%v.....-..A...........y="..L.H..",...f.f....6./4.S.>..o..T.......gj.[......N!.\.....@#....x.Y.BZ/,!r...%.L......e.....c..V..+.=.4o.u\....P.Bs5. .ba..!H...S*.....=...q.&.;..w..F..........m..z+....J..gFJS.Q-dc.&.......G;.......r<X..2..........#..O$z..'..G.Hc....wN.>..l.p..!0M>u...5...&.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\qex.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2323176
                                                                                                                                                                                                                          Entropy (8bit):6.740655319251901
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:Z3UVETD+ZFk1Z/bwsnmgj3XRcZTKgWJmKY+xxH4:Z3HnF1Z/b5mgj3BcrW4
                                                                                                                                                                                                                          MD5:EEA1D0D4EF886E716B00BF4B4B5FD206
                                                                                                                                                                                                                          SHA1:34020547A5EB84B59FAA00B4B453C6705041B2F0
                                                                                                                                                                                                                          SHA-256:0D94148048D56B1E93860FFF884B1F06CE4F151F36335816B871CDAEA362B557
                                                                                                                                                                                                                          SHA-512:94234BE704EF2E6D75C479C71AA7A2048D95E623DED2D0D9D45465A3948FDFF389948E4DA33BA60FB0C89B9A493E7347A6F12B545233087C5D9608618CD8ED2D
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Yara Hits:
                                                                                                                                                                                                                          • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\qex.dll, Author: Joe Security
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........4..EU..EU..EU......WU......U.....dU.....GU..~...^U......FU......LU..~...{U..~...aU..L-..GU..L-..RU..EU...U..#..DU..f..DU......BW......DU.....DU..EU..DU......DU..RichEU..........PE..L.....Be...........!................`........0................................#.....C.#...@A.........................0 .P... 2 ......0"..............F#.P,...@"....@...8...........................x...@............0...............................text...j........................... ..`.rdata.......0......................@..@.data...@....@ ..l...& .............@....rsrc........0".......!.............@..@.reloc......@".......!.............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\qex.vdb.enc

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):783952
                                                                                                                                                                                                                          Entropy (8bit):7.999548254071398
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:12288:+A8FCSM+GUoLBageOVTX2KYVKmyYKSc+fM8yq8VDfKSgoyW4cvttlO+8o/0:+A8FChneCXkVKcbchBZDfjltld/0
                                                                                                                                                                                                                          MD5:868E8C37A8E4C39407DB116EFBB45A24
                                                                                                                                                                                                                          SHA1:A394A2E97E8B579A1E37EA89612D1A1FEBB666A3
                                                                                                                                                                                                                          SHA-256:882B78B7659C267BEEF7CD4CEC9901AF0F0DC38310D610133B9CFF51E29C8F56
                                                                                                                                                                                                                          SHA-512:55C84149F0888A844F9FB4443ED1C193DAA48A48A81F543D0F121DA20FE14EA77F62B59034691AF670325149391E033E32003E2D5AB5C1A63A9F63D7E23D66D2
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..z.>...@..............\ ..p,..........."...q......t..a....?.U.|V...^x.H....@sf...#.:dd..z.&b.G..u.u...r,.*..`\..V.h........S..R........]...}.=.K..r..E......wM.~.?.U.|V...^x.!r23...1...[.6.g.....K9h=jT......^..M..)..|..IK..V.............r..E......wM.~....@..._5.6Nn...g...<p^j..".8..+S.*n0.[....w..3(...... .........=.z...Q...C..*Zq0......5.0..O..~n'a...Gl.J....:..=...D..&...Y...Pb.q.N..p.r.k..j.....u...t.Q/.C.|...4..T.'...M.I$..qR..B.K~..w=...H.;.....&0.".f.....Ay.eg}.'.OV:}S!.....tri>.nl.....W Z.p....P.|.*..G...,Z.^..x..65......q.@@...0...h....K..J.).....T.>).D9.........M.?.QQ.=.[.....0.^ R..U.0...O....o'.GPql...d...}....H`z.D.o'..Q8*...N..x.5XX....?....<W...3;.Bq......J..x...a...g..].G.'.y..G.T.Ht0A...*>..dh..5...A(.>.\.O$.S,3%&.:MN.G...,Z.^..x..65......q.@@...0...h....K..J.).....T.>).D9.........M.?.QQ.=.[.....0.^ R..U.0...O....o'.GPql...d...}....H`z.D.o'..Q8*...N..x.5XX....?....<W...3;.Bq......J..x...a...g..].G.'.y..G.T.Ht0A...*>..dh.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qex\xyar.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2311944
                                                                                                                                                                                                                          Entropy (8bit):7.953249086524935
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:vDeM7mijYfraq6kn9eZ3Ki6JMgaVoF1hVIhgOPMWSblMyFO27:LeM7mij0Ln9eZ6hJMgO47iQ
                                                                                                                                                                                                                          MD5:AB8BB63E3F7D8359ECBA63BF65E5F299
                                                                                                                                                                                                                          SHA1:586B8664927DE921E1DFFCDD8B8C559063BC7C8F
                                                                                                                                                                                                                          SHA-256:2305176A05AC17A67B613CF4352D6B6AE209CA58FDD13F277FF7B04500FE393C
                                                                                                                                                                                                                          SHA-512:732389F737A0E07C510E2822684C8148F5446BCDC401425062A0F085A13762408F14F4370A88FECC34836580467B7B872891CCC8227A77F5FD8C8BD2EE31F771
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:XYR.......l.M...)......)*........a....9..W..v.'(.=..)e...v..m..R..y.....%.2.1...../.g.....2".....r1..6....c..Z......X........=..cE.i..N.....fEr.v.h...H.3A.F,.....{P.....}.B......nM. S...[.NY.UZR...C;.9.4....f....Q..........</..{<dj....C.%|.........]...!x`.<....E#.x..........AXrX..!.0.K...8..:...:e.b...F...S.95..:eJ.....B..*2.Z..i.......v..........=.......]..umV(.rK.O...Y.....a.]7.......Rn]........."..{...,....^....r....y,C.U...W...X.....#..D.h...]......u,.W_}.....".....'...m.........b.y....nz+..).W.....>.....9L..2}...O.....f...?...g...-._.ez..#..K.._.3..>..........{.m.M_.~~....V....w.......o>.................k.u~.......}.P.L|9...?.....g...P....0}'...;..%M...'...._..a./......../L..3...A.....k._ .O#/.........eL?..&y+...Ly...{.."|.....Z......S.....$...j...._)...S..?.........?..]..?..........O.o...<...P...>.k..!|.z.?..C....O.Cx.....^..9....[C......?.!....4..!..1....7..!.Q...~AS.+k..A.C.*...oiN.C...CxO....OhI.C............'o..g...!|.(...?....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qutmdrv.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):413776
                                                                                                                                                                                                                          Entropy (8bit):6.576321419021263
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:XqzPJBhlcuP/jzmLBVcnjWxh2EbxKzc1Dc/5snj09ADzO8b/fZ57mcV:6FJcuPWL7G+QWyBHODK6nZ5R
                                                                                                                                                                                                                          MD5:CB888CA434A350529A5714A941CCBC49
                                                                                                                                                                                                                          SHA1:C5450D1D2FBF579EDB7697F413F8FFE7DEEF224A
                                                                                                                                                                                                                          SHA-256:13C357D31EB6DD253E625C0AC1E94714260B75CF7A141408750B7E0124E94F23
                                                                                                                                                                                                                          SHA-512:76545013E16C66904686C8B672E374EAC8080F9833852411B2BB21BCA065682F93871D45ED279ACE95EE702E4DE48B205DF802AA8C213FFBEB1394668EACB4F3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$..........].I...l.2.N..[_......6.w.^.Q.O......|.].U]\V....8..)...:k...b..q.',..vDy<.w...........d,..O.9.v..5.iZ?k".lc.X%....U.i..5..veU.........................................................................................................................................................................................................................................................^...0..0..0....0..1.{.0.F.m..0.F.?..0.F.o..0.F.n..0.F.j..0.Rich..0.........................PE..L....ve.....................".......|......................................................................................$~..P........................R......0Y......................................@............................................text............................... ..h.rdata...^......._..................@..H.data....`.......a..................@...PAGE....."...P..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qutmdrv_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):413776
                                                                                                                                                                                                                          Entropy (8bit):6.576321419021263
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:XqzPJBhlcuP/jzmLBVcnjWxh2EbxKzc1Dc/5snj09ADzO8b/fZ57mcV:6FJcuPWL7G+QWyBHODK6nZ5R
                                                                                                                                                                                                                          MD5:CB888CA434A350529A5714A941CCBC49
                                                                                                                                                                                                                          SHA1:C5450D1D2FBF579EDB7697F413F8FFE7DEEF224A
                                                                                                                                                                                                                          SHA-256:13C357D31EB6DD253E625C0AC1E94714260B75CF7A141408750B7E0124E94F23
                                                                                                                                                                                                                          SHA-512:76545013E16C66904686C8B672E374EAC8080F9833852411B2BB21BCA065682F93871D45ED279ACE95EE702E4DE48B205DF802AA8C213FFBEB1394668EACB4F3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$..........].I...l.2.N..[_......6.w.^.Q.O......|.].U]\V....8..)...:k...b..q.',..vDy<.w...........d,..O.9.v..5.iZ?k".lc.X%....U.i..5..veU.........................................................................................................................................................................................................................................................^...0..0..0....0..1.{.0.F.m..0.F.?..0.F.o..0.F.n..0.F.j..0.Rich..0.........................PE..L....ve.....................".......|......................................................................................$~..P........................R......0Y......................................@............................................text............................... ..h.rdata...^......._..................@..H.data....`.......a..................@...PAGE....."...P..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\qutmload.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111848
                                                                                                                                                                                                                          Entropy (8bit):6.720613767994389
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:Pq0VnhM7xysvUrM02pYICD9GIwmooxdREenP0J:PFhM74bwvY/D9qFoEeMJ
                                                                                                                                                                                                                          MD5:6A384987E2556E8B16E267C49FFD00B2
                                                                                                                                                                                                                          SHA1:EF9DEFB215F271BA08F50F646B11A6A025D9D5C9
                                                                                                                                                                                                                          SHA-256:0839FD7158AB508CB51135221A573044A4A5F86D21D2654B2BFCB4CB4443577E
                                                                                                                                                                                                                          SHA-512:6AA59434A192FB1B62E85D4FF8B16819DCF4927B31CD78175DFAEFEF452D8C32866A4FCA97FBEC51C05DE24280EFCCE005AD3A39E276776E27A6313D66B37C79
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........z...z...z.f.'...z.....z.......z...{...z.....z.....z.......z.......z.....z.....z.Rich..z.........................PE..L......e...........!.....\..........8C.......p...............................`......WP....@..........................Y..x....N.......0..................P,...@...... ...............................8%..@............................................text...h[.......\.................. ..`.data........p.......`..............@....rsrc........0.......f..............@..@.reloc..x....@.......l..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\ramengine.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1153496
                                                                                                                                                                                                                          Entropy (8bit):6.942405258763643
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:Y7q8Cmtvv8T/2xkz88j8F7mA2CgVuHjnbbpyqTsziz824xzoxzD9+zNzXXVoyf92:wKEMqxkzvIdTjbbwqT5z8YuXVRf92
                                                                                                                                                                                                                          MD5:2172263E6F1E7EEFB2C54517B1215243
                                                                                                                                                                                                                          SHA1:0EF23327AA2F0EA7F2C74BA7A90C3FCD03A37238
                                                                                                                                                                                                                          SHA-256:30423D3CA90C921D2A727B0A5F8C4CEC1A63823283B84BB6135C866CE33FA23D
                                                                                                                                                                                                                          SHA-512:CCAA6CAD97380B4B70CA80B119B04D2D50BB4F1C018C168F185EBF7CAAED00F7E8679F2BC898B86A99F9B6EC15D6A4337EAAD2A2A03DE3E6D71A11D57762DD14
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Yara Hits:
                                                                                                                                                                                                                          • Rule: Gandcrab, Description: Gandcrab Payload, Source: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\ramengine.dll, Author: kevoreilly
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h.rE,}..,}..,}..2/..(}....q.-}...2..-}..%...1}..%...`}....g.9}..,}...}..%...&...%...k}..%...-}..2/..-}..%...-}..Rich,}..........PE..L.../.=b...........!.........................................................0......`.....@..........................I.......8.......`...............Z..@?...p......................................H...@............................................text...`........................... ..`.rdata..dz.......|..................@..@.data........P...j...4..............@....rsrc........`......................@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\rmt.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32680
                                                                                                                                                                                                                          Entropy (8bit):6.710735288103512
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:dwGBVvhNFmlRsB0Vh9fhSzFuOoakPbVZ4fnYPLdOSeM/PsgjhQhG5GEncTHT:uiVDFQmB0VjfwpuOo9TTWEU+LI
                                                                                                                                                                                                                          MD5:51322E157DEA6DB76F043D8F54B5D94E
                                                                                                                                                                                                                          SHA1:111DB39F6C886EC7D9C5D55A6B6CA0A61A572587
                                                                                                                                                                                                                          SHA-256:AD38EA5A38C6063B4076D829E54332F230C809868960FBFC1F78157D8C0D604B
                                                                                                                                                                                                                          SHA-512:A91131BCB98DD06444654171D81F70446736487CAF539E0761A4947D581120516F932A30F81D50B3AE4B2CA72EB0BFF0605CFFA6169FF3463EE0480F186D0B18
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........GCa..Ca..Ca..J.H.Aa....M.Ba..J.N.Ba..J.X.Va..J._.Ga..d...Ha..Ca..>a..J.Q.Ma..]3O.Ba..J.J.Ba..RichCa..........................PE..L.....[X.....................*.......".......0....@.......................................@..................................=..P....p...............J...5...........1...............................9..@............0..X............................text............................... ..`.rdata..@....0......................@..@.data........P.......4..............@....rsrc........p.......:..............@..@.reloc..|............B..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\sbx.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):419240
                                                                                                                                                                                                                          Entropy (8bit):6.3692589597258555
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:vWmD5RSx5AgltncLAFzI+ua2sKvp4LEeTl09LafWOtcL1PWMj:vhRI5xtcL/vp4LxTl0Jaf23
                                                                                                                                                                                                                          MD5:92532BBD24EED5550BF59CB8D5250D37
                                                                                                                                                                                                                          SHA1:EFF4A23342E235266144AFF0D432E986EE28BA6C
                                                                                                                                                                                                                          SHA-256:71493D01F2824BAF454281C3B66FC1881EB73BF27FDE6B7ECCA7788B24669FFE
                                                                                                                                                                                                                          SHA-512:6838AF8F70C4E539A3E9BB9FEA708781CB1E9CD5BB49517CF4F3B5797C1E79DD47AB150E7DB6DDE27629AC2D2F7FFB9019BE7CAFF859E0A109C3E2EF43F1E371
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........vO.J.!.J.!.J.!.Co..G.!..X..I.!.Co..Q.!.Co....!.m.L.B.!.m.Z.U.!.J. .-.!.Co....!.Co..K.!.TE..K.!.Co..K.!.RichJ.!.........................PE..L...~.[X...........!.....`..........@........p............................................@..........................=......4"...........0...........0...5.......6...u..............................H...@............p...............................text...._.......`.................. ..`.rdata..)....p.......d..............@..@.data...@t...@...4...4..............@....rsrc....0.......0...h..............@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\sc.con

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):554
                                                                                                                                                                                                                          Entropy (8bit):7.6610228980266175
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:L7YceWeEr2suZy0Mt80+z5l9iaMsrx/IMw4Fuae+QT:4s488PNoqlnw4Fuaeb
                                                                                                                                                                                                                          MD5:A565DAE10CA9A5DA0F3E1C6213BE727D
                                                                                                                                                                                                                          SHA1:13762416B6B75A4DAAF6A679A03775E76C9516BD
                                                                                                                                                                                                                          SHA-256:B168C87CF09AAECE1FF0E6807BB3692BFB9FD4638725E7D9C0768E78E7B64092
                                                                                                                                                                                                                          SHA-512:075B585FC5C1D6B8817EB3965E0F316525A94C2E8743310883D624E8D4888966C97D5F55C93427EF1C9F680F1887C0500A5051EA32CFFEB35C79C41C530D137A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063.............0..k..x.....Ex..V1..0......SF.x..R.Z....._.N.:U!x.r{........n.@k..Y3.uC!..%_..!.q.....O.c..41.)p&...e..h.*GB..nt....d4|..^Q..+........wG.H..!.Z......!..I....c<HK.c.nZV^1.4..j...9J..boC..bD..\1...z....OZ.*%..#NNm.?%..7...&..*\..P.1p) .}\~.......b_.xb..HgJ5.b....t.....b."2.g.e.yR..K...u}*.....:......=b.d...n.CN...9..9.=OU'......e...G...L.P....6q.1y.4......S.X!Fd.5....}}...."..>g. s.....n...p....k.qX..R....).>.F/~Y..L9....&[/..9....u=(+./.{.Y.n?G.7mm......i....d.'.#;.pl..8..a.7r.'?d.;J;g...x8.6

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\sndw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10905
                                                                                                                                                                                                                          Entropy (8bit):7.980217270396347
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:meCljsgLGjtE7aJqb161R8hnCQeTwm9A3LTc+wKLgZpzXCHb45WxS8Gvn4Qan:mnwgLGjtaKkdn2Twm9qLAKLYXqb45eNZ
                                                                                                                                                                                                                          MD5:6C8FDF3C1540E6655217BE763D4C048D
                                                                                                                                                                                                                          SHA1:2761810E992CF87D0314A57ED5C42BCBCB22397B
                                                                                                                                                                                                                          SHA-256:5B505CE13A3F69728CBCB964B40D8D510E9B494EA2A33F2A965F68E39DA4FFC6
                                                                                                                                                                                                                          SHA-512:B5AF79B15019BC3A6F3E74A802D9A29AE5F0530245DE263399A5FABDC26FA08A69B3E8DE089DFE5171D2921D79A00CD7AF45F196E8A491D6B29E4AC39F06AE4F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............]*...6..................L................LLLM.3LLLLLLLT.N*..Z6..X..|jY-yF..*....?..D.).r..\%.G...w.k.M............9.w.Eq....2.=.e....W..~I...5.;z.S:...?.L{..T.m.pBM4.s.D......u.K;..h..r"..O>..X..D.y.T.......=..........i.&Y...B1\.g..!.......e......ck^uC.]...H...b......+..`../ w..k..B...R..y=L...ez<.&.[....js.N.hg...Y.y." ,/.L.gc.]."...v...p.t<.~.C..0+.H1.p..Pz..B...G..f..U..6.rY..n..Ivf.. r.'.5+/M@._.vY^.h.e...........s~.iO....j..U..........76...\x...{`7v].H7.m.YA.-......!.1s..]. ...~....7Z.nb...... ..3.}..;.......B...Zx....^..A~Y...zY..S$.6..W_.7"D..%...\.n0....]...............K.y+.9....j.........Fun.!.8..J.Y*...d.$^ ..2{..1 ...yYQA......Im9.E.M%......A....".y.bo.~F4.+-...;.P.....S.j\u[[ E. V....g~...~..{.n...N.m3.....9..[..q..J;oQk....t...?>...F.'....k..h....'..P.....I.&..e........,.eM...lqCX}|....h.}..B....Z.+(e\..m......P.i=........mk.w}..w....h.Y..,.\.Ph...|e.T..3dM..[.;q...~v.......|../%.=...W.W..6N.hK...@.@c.M.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\stx.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):361080
                                                                                                                                                                                                                          Entropy (8bit):6.261967462692479
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:kxGGaZSZ/PDD8MXgyameXmMZoG8Mb5jdaxwrDrTUNGcAAq8:/xyvwixG5b5jdaxw/rwNfZ
                                                                                                                                                                                                                          MD5:B389153583106241865696B542A7603F
                                                                                                                                                                                                                          SHA1:0CE5825764B55FC7A961A73A3F8892659FF3CDFD
                                                                                                                                                                                                                          SHA-256:52B2167470E675CF5A97F8C9F8F10EBA3D5A7E5655BB9D72AD2D749E3E7CDBFD
                                                                                                                                                                                                                          SHA-512:FFB845A78B6780E96FC7E1FB595783DC23FCE14F61094C0E6322E47F258E8CFE8523054FF06A90517228D569D545F72C149D85766D50D07444A20682B9C5DC40
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............{a.....YL~......{}......{k.V.........................{l.s....{z......Q|......{y.....Rich............PE..L...:$tV...........!.................h...............................................C....@.............................?....m...........0...........l.......@...-.. ................................4..@...............l............................text...3........................... ..`.rdata.............................@..@.data....w.......4...r..............@....rsrc....0.......0..................@..@.reloc..8....@......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\sysfilerepS.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):296448
                                                                                                                                                                                                                          Entropy (8bit):6.525001769554265
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:akQR4/gW/ulyJQks7fA8kbJHP9wgZLtGvZxZcy2:WRjW/ulyJQksrA8kFHP9wgFsvfw
                                                                                                                                                                                                                          MD5:080B406556B06942C740D1B27E35B76B
                                                                                                                                                                                                                          SHA1:DF0E1AAD009CFE0436C476619E9A046C74957F67
                                                                                                                                                                                                                          SHA-256:B6D32F193CB1309963E0566ED54551854ECE722660726460C76713E1358896A6
                                                                                                                                                                                                                          SHA-512:9256D83202FBC79469DB533CC0FF5E779B2A07AAFE4CCE39AAF7CB96006A91B2AB2F62E43E6EBCBC32B053326FCB1764866B5698B85951FB7C6959D41E4CE616
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hUX..;...;...;..q....;..q..f.;..q....;..[....;...@...;...:.S.;..q....;..q....;..[....;.......;..q....;.Rich..;.........PE..L...7..\...........!.....0...................@............................................@..........................................@..H............N..h7...P...$..0C..............................@...@............@...............................text..../.......0.................. ..`.rdata......@.......4..............@..@.data...|=..........................@....rsrc...H....@......................@..@.reloc..<;...P...<..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\deepscan\uiitem.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):582
                                                                                                                                                                                                                          Entropy (8bit):7.398509004285834
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:yiLil08ZW7PZWiSgLEKelZRjC/L8RZ584u0wn2o5:Xo0wW7PZWeLZejRjCoRx/wn2o5
                                                                                                                                                                                                                          MD5:39055D57C21F8F24C4AFCA36D20999BC
                                                                                                                                                                                                                          SHA1:CADF981B5C602B171D020CEB4055A0865FB76A94
                                                                                                                                                                                                                          SHA-256:41179030857B60C9A2E96DE9761152A5F8EDC7FFCA4E310AD8D8E52FC110DA38
                                                                                                                                                                                                                          SHA-512:0E1A7FF13B51EB593F3FC738D873901EE5CC4009A4799C2DFE5A10D2D2F269019E23DBE458F2A401B963DF429DA6A46DE575E1DA8DC7233CB067D6D351809C8D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<....................v@.....,T..........L................LLLMVQLLLLLLLq.NR5!A.8B..r.[...?.+T.......j1l..j....7z(...@.T.aI..dk..0..'&.~-Eds...%...v....+..!a.k5.:.#....E.H_._.p.......f.`....d.*8.....Q.j.:.... A.E....qz.u0.9|. ....K...${.rsv.j6*.eZ.8..V..cR..A...P...Qy..c..?.8:.z...0.G..B.m.=k...}r..c.-oS......MQ6.....rh'...e.......o..<.iyt..`.%2.>.......t.*...G..0..".;.....d..}.7(&N..D%..>.5U.0...%..L....N.4......>.$e...o].v.o}..J..@/.F....0h...X.....1l(..x.....d.}.G..4......YL.....r...0d............,X:.A...".?...r)[.Y2......g.M...JQ.......... t.xLLL

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\dynlbase.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):854856
                                                                                                                                                                                                                          Entropy (8bit):6.382584683429729
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:DSm70eV/QhMgoRIbD4gj05tJtDPHaamSZAZDBOffG40N:F0eVUMgoRIb3jwRPHaamSyZDBO3G40N
                                                                                                                                                                                                                          MD5:DA433A919154394953B5C925D6C7946B
                                                                                                                                                                                                                          SHA1:4D582CDEE8445D25E1D62FCC52EF75A51B868769
                                                                                                                                                                                                                          SHA-256:EF8ADDF7B32B592D5FD0CA65FC9824E90D2DCE200641756318E6089A9A02921B
                                                                                                                                                                                                                          SHA-512:E175CFAA8B63CAE64D7948F37E32EEB7DFAB9E5085B54CC47B68C4A1F5C0D1BC184661E20569D2108A86070BC7817DE37D1A0BF405D915A774D5BE831EAEABBB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r.....}...}...}.\.}...}.k.}...}.k.}V..}.k.}...}...}...}...}...}...}...}.k.}...}.k.}...}.A.}...}...}...}.k.}...}Rich...}................PE..L......T...........!.................d.......0......................................'.....@.................................|...|.......D.......................D....5..................................@............0...............................text...G........................... ..`.rdata.......0......................@..@.data...............................@....rsrc...D............"..............@..@.reloc..D............*..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\dynlenv.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):569344
                                                                                                                                                                                                                          Entropy (8bit):6.754917311700817
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:mbMIVo80kna5YTvKAVwpwhtmVfzHW8PToqPeg02HaKcGlVimE:yBt0t8G0OaGimE
                                                                                                                                                                                                                          MD5:63952A153CAF0C01A3F02A3DAF87DC55
                                                                                                                                                                                                                          SHA1:ACFC41F95E2EBC11DAFA2E643EBB8C611C2405A5
                                                                                                                                                                                                                          SHA-256:6DDFF0BEEF053F640D662D6F2C8DF9AD2C01CB44E14FE88565815C17B911A2C0
                                                                                                                                                                                                                          SHA-512:A75AA8B44B9E65E2461A4CC4B99554D6464D932B6BE3E20ECC568F7FCA651E9B701945300B1454AB270CB0DF0D6D65756250F6D39F298BEF500346C0B2D2777D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j...........>./..'.=.l..'.+....'.,.l......!.......'."....'.:./..0.<./..'.9./..Rich...................PE..L....COS...........!.....p...........................................................&....@.........................p...r...p...x....p...............x..h7..<...l8...................................................................................text....n.......p.................. ..`.rdata...{.......|...t..............@..@.data...<b.......0..................@....rsrc........p....... ..............@..@.reloc...F.......H...*..............@..BQProtect.............r.............. ...........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\endata\h_1.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6144
                                                                                                                                                                                                                          Entropy (8bit):7.972302075896879
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ulrhAr3CYu3+kJVG0/0d/OcWMjMDH//bw7oI3QEBE6SKHoVEAPe84RvckH5yLE:UKr3CYujjG0/0N9juH/Tw1IKIuAgvcyP
                                                                                                                                                                                                                          MD5:1E132B8BB455348E10714B0DFD95AADD
                                                                                                                                                                                                                          SHA1:1B757A4A4FF71B517FC80BD12C1D7B18441D2E50
                                                                                                                                                                                                                          SHA-256:7B2AC16F9E8F6E47AF03C277C99E504327D219CB359D6A1277C2F9E9EF139278
                                                                                                                                                                                                                          SHA-512:CD919276543D4D57DCE68C504101E7401872D27DC0D361C8FFA690B1D024615B337CDF9F0B5FE2B63944C9CE94418C1D7203A720FB099562388BC4F9667B8CDF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....)T.4.i|l?n...q......m.8...L..~e<B.w................E.c].EU....U...c.5M.u...|...s.:....}<sc.q.7f..'6K....s......!8E..]..`....4.XJ......+8.X...W.%.....<..p3..8.A.=......h.W2.&..f.~.Pq....<.#.^..M#r.5.T}2Q..M.X.P...r;. .N..-P.>f.vH`.l.'c.......=.3j..Q......9.;..x]?..l7C.....0_..?..)F,.O.....fO`....R.ee.>....ywg....X.G....j.~.......@=.t.'>G.bv^..b..y....hp.....r.@.Q%.D.4..Wf,{..&|.=/..}c..6. 4....W...`.....:'.7J.XO....~.l.$.JR.=f70......7..y.,]..<.....[....x)i.......3.w.hq...o.k...$#.n..S.....!B......j...7.0........P.? .....].....}.%........B.^@...2.q$...\..>;.....dp..a...\!.....j..J(F5.j...D.Zb;.`....@;.|B/.3...5%.. R...#b...s..Ww.Pb..M..\T..b. ...$O...c..im....V[..>SB...N../.......C.\.&8E..Yc=.X$n....Y.........^VAv....../..|.......`.sf...{.%O:,I.&.WJ.*.n..c="...4X.%..b....[W!x..*...1..Z..'...I.='^...C..VR..&1l7...._.D..............`..].h]>J\.........4.(.eB{h..Mn0.....a... ..+..,O2..BW.N?3@.|./..$B=.?.7.k..X...!.y..Lo<c...@*.....E....MA.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\endata\h_2.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2720
                                                                                                                                                                                                                          Entropy (8bit):7.931219506186732
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:zYT1f03VNLtx9mwuJMvJ6Dfnj2CWlOJ3WF68XKlR9pdTAWa5fO0Cqx:UT1cpTcJg0Dfnj2CW0dW/XKxpdHa5d
                                                                                                                                                                                                                          MD5:B8B1C3B61D375B52CBFDE81111C46DCF
                                                                                                                                                                                                                          SHA1:8A2A6840B2C71032FCA2BC5A54ED2EDF181B7714
                                                                                                                                                                                                                          SHA-256:56C79FB3E3917D876AFF525BDF528B0888BD3212C519F95435ECD846F0195061
                                                                                                                                                                                                                          SHA-512:7DFFCA5F3C94A8F0486FAB5841F8926B4FEDC6331D320C766C829D4D2FDA899395E6F466008ADBF3788145809B1C0E43514C6BB3D56A26243EDA5F861E716857
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..R.^...k(....3,..T..d.i..@*.VmK3../.PPK....._........d..O.....B..]..g...nU..n...4.`..Aw....%A...]P...v....p.C......v...r]..cd.,=S.b...I./.?k.o....%..H.e..xH._...<.."S..@.....(bvHJ......@... ..^&....7.".. .lp.i>.i..G..0.f1.%...&..E.6;..;g.N.8....v..bZ..L.(.F.........z.^..>'.v..n.9. qP!6..L.....h..Q.x.pC.).ehYjMY.[....c.'.8..h...a\..J....D.O......D.....R.!3....t...@.+..c...Rn.yz..5..=..0.i..0Q.MN"[p.s.g.4..F... B.1........Q..:KA<:.tEv.....~{.%...5.[...!x..9..$.s...k.#.W...B.h[.4...BD.A.......4V.b-p.+..o.XE..n...Nt......!.....J&...s..K.X..kL*xO.idA.i...H..^.DI./...A.?Bm.wO...y.....%C...o.D@.%`5z &."?n}A...v.F9.j.ta...ND.......nw..RB.a.........[l,9.:....wAl..].WU5....../*.w..dc_#..._..X........!.t.-.b.o.1.`.d.^.g.. a....P..M..]C..L...4.....J.Q..e.....3..Fkv<.L.......u..!"s..ju..}.'Iw..k.....zo..1...L........}.6...uwv..K.J....v.wM..7I..gy....et.`.R\.S.QJp...m{^M.i...Xv..L...r.../(n|.a...w.+_.#..G&.@..*.u....A...|.g.;...n).Rd..$..b.........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\endata\h_3.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2096
                                                                                                                                                                                                                          Entropy (8bit):7.910664343373737
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:DqhKcUr6LzMATINIv0Y5rSJFaY3dvsYTRqqfpZOlqHyZi5hiGREM4a:OUcUr6LzMATIpc+suMqNS40nM4a
                                                                                                                                                                                                                          MD5:2B50F42C2666D6C34DB2A1BBEA715894
                                                                                                                                                                                                                          SHA1:8270036DF2BD415E6FA0C3059F92971085F8B0A1
                                                                                                                                                                                                                          SHA-256:F26B4C2AD118F8836B471F52CFF3A69C8438869EAE11C75864C74DBD79BF25C3
                                                                                                                                                                                                                          SHA-512:18F4401442E2C9A6047D1390BC14E757B4273D72368471C7AAB4293EB543BD822D73B06C5AC7C99796090EC50637CB35F5CE6EC35F4A9E446A2AD175499BDECF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:`...u.u.c..w..;v.&.. ...wt..`........a..P....NB2...k....y....GN?.......3._.B..c..b.|x..@."*.w....Y.Z..D..!.Y..,..So.....f&.`R....3..e.tw.?Y.$.L.5.[+......+y...h.7.l".'T.UL...o}4...@.#....bH..\w..s..x..B..i....a.t.U...xI.A.VI\.!.....6...1.?....k!......PQ.HsGR.T.BncJ.u..R..}L=>...QM..u ...'.H.bz...7`j..m..\.<.X.CRr..#&~W..3..6.A}*...=1.KHW'...[#.... .....O.DP..sG.....Aixt.j..x....8}.....R=.1.p..A.U0...5.Z..Ge.bW..IZ..b........Q).l.Q-ze.....Fw......t.S.d..zZ../..n.t...`..+(.N........ !=.th.0...0N.A..5.5...?...+0.|....n.m....`_(.Y~....K1.^.J}..6..rT./CN.y.d%G...w..[.e(.x......D...+V..t.....dsw+..G7.d..Y..e..9.".....=..{...u....;....W..............B.(.q;...p2..t.>8...J.....2e.......mi..hh.lc..&W...7M>..k.....a....r..7.1*0:_I.5........~.>...n....m..^..(t.S.._n+e..3n.s...\.h.Q.s.\q...$./..ik.c.B..FX..L..jT{..f!....A.$>.2...6ray....YL..L.K..pI..M.a.....m.Q..&y...v...u....N.$A...Z./.u\;.0.M..1[.....3=...5.H.b.Z....^8.-......o+.X...3>..X..z..(.b.='F.(ei.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\endata\lm_1001.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1984
                                                                                                                                                                                                                          Entropy (8bit):7.912425836478567
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:3FlLslm3oRdujZG750jf65ce+jdvur9KqzxLPiPP5UUo:fAlA4SjfPe+jdm9zdPiPPho
                                                                                                                                                                                                                          MD5:EE415356F54C7EB4C4BBE31EFE9A47CB
                                                                                                                                                                                                                          SHA1:A692BCB9F1496F5D6BD4FAFB35D4665783E14E63
                                                                                                                                                                                                                          SHA-256:0D9B393BB26615EBDA86412BB3C74D5BF777120F1FA0F857C610636D112D9BC8
                                                                                                                                                                                                                          SHA-512:987500142BC87EB48BF822271D4090D997ED6C590662C1B50B0D3BC87315935F788D70F01D4EFEA0093D6FBC65DD151DD03EAA7C013F7CAA1CA464C4205680A2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..@zrR.O.g)..zx.oxs.Z.P...O.k"w.E.%....7k.;..Fa;L.0.0RV+.?.s.>...+.^^.t...9T.......`..-6.D.E../...~.Y...U..c.u....4=.......5q.B..V....T[.7YZ...F.......w.4..!$.q.....lv......__.|...Q......^58V1FO.d.*..S<..G..3.|...)!./..f.>[*&......!...311........'..9Kvj3..ZN.wo(...`.....U.<U.u..s...<m.P....?z.3...Y.J.6.2/.s+Y.$b.K...sj.&.j.CC.v.(.(v=2...q.]..n...s...m[,..'J|.x.ob?...(M.P.L.}.@..a.R.... .._..\:E"h.Wy..g..*X:..%.....J....L....f...k....(...].s....H+.n.(k..0).nP...i:.#H..,")..).Z....6.yA.a.....E.....Od..{p =...<.^..XdP E..{...g.]....D]Z.._B.qS.K&!FY@.:.;....Q Q...X.... .../.R..B.b.C.JG...W...)o......-A.Y.s}/."w.K-..B.X.p..3~*...K...E..5.9...f...v.5...6y.A...N..!G.'...b....O.t21.I.......n....2H..*.M2....b.........Ig.D$.LM#....q...^.C...........C.Z.p.mR.3...2W-..i..y...{i..i..B.~.A.j..p...-P.q.....zq.....p..I.....]....s...D.._.2.........:....kO.d..u.....$..[9..f"=g....TI.....p.X.f..M......odhm..%.4.R3..*.../...^Y.+.1.;.q....v.H...K...8..g{}=Yc.S

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54632
                                                                                                                                                                                                                          Entropy (8bit):6.777470746198313
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:AIxy3SYobgnDmPGwKsBjDaDGDoUSlcCmunI2gVoPoCb1mFD03hw:FbYoaDmeFsB3XSlRnImPo+1mFD03hw
                                                                                                                                                                                                                          MD5:DA5E35C6395A34ACAA5A0EB9B71FF85A
                                                                                                                                                                                                                          SHA1:5DA7E723AAA5859AB8F227455D80D8AFA7696E22
                                                                                                                                                                                                                          SHA-256:5E11C25E4D6E146C5E10FCBC21B2CDB5E97EC47F25C416E5D263985F3D964172
                                                                                                                                                                                                                          SHA-512:49660339594ABFF9B0590BC3F401634A514834CF98FA8715B05A57A3CEA575D74859681984D8C2C601D5FE947701F8F110450FAC764A5D32096E24D7EADCDD2C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t{............{.H......m.......m..........2....m.......m.......m........k......m.......m......Rich....................PE..L......]...........!.................{..............................................W?....@.............................F............`..t................4...p......................................(...@...............|............................text.............................. ..`.data..............................@....rsrc...t....`......................@..@.reloc..t....p......................@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):85744
                                                                                                                                                                                                                          Entropy (8bit):6.884660853790976
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:uX7Z6EaDLE8sy+Xbbs4Br8PeSd8SWJRM8a7DbfCQk54ImVzjU3P0e:0N6EaDgQ+XbY4Br8PeSa5JRM8a7DbfCF
                                                                                                                                                                                                                          MD5:86D92FF1F211F9704D0A5EE744DC5C5E
                                                                                                                                                                                                                          SHA1:21120D96DA72B7A592DFDBE918E2DD8656F0CD2D
                                                                                                                                                                                                                          SHA-256:79EB282821AA728F0FDFDB07A1FBA273AF83768614E026BC8E371655E398BD50
                                                                                                                                                                                                                          SHA-512:B547EAA0B43CCF1AF913C94AC7831EDAF45D15428FD017D8F41CB8942156A453C381D4526A0B51F343093F854B4C5FDB716BDAA366101CE652CDEEB83F5DE2C9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$..........Q.Z..k.{U|.Z.[Cc.&.FV...&p....m......;d.#."$.I.rH.9C.......ks.-n.._..>o.b...q..B..(...,U+.U.,....hUGi1..}yp....#sv.|}.....ee._..........................................................................................................................................................................................................................................................X.UX.UX.UX.U&.UQ.$U_.UQ."U\.UQ.4UH.UQ.#UY.UQ.&UY.URichX.U................PE..L.....ee.....................H.......".......................................`......i+......................................P&..P....@..................XR...P..p.......................................@............................................text.............................. ..h.rdata..<...........................@..H.data....*..........................@...PAGE............................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt64_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):100592
                                                                                                                                                                                                                          Entropy (8bit):6.592857038022857
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:PPzwDmyyTwGIfCWH0seX90ZbgOMw6t42RszQrtghXiCnBztcHqj4xmVzBGUhP0mD:P0DmsC8anO212A2XiCnVtcHeVGqP0mD
                                                                                                                                                                                                                          MD5:12426837392E278838D1501A5F324398
                                                                                                                                                                                                                          SHA1:3BE22DF43E2BCE3690C92188A76FA33A8A581D69
                                                                                                                                                                                                                          SHA-256:4FB3CFBF91BC27E867D8F58081FFD3BE361481E2270627825CDFD13EEF50EC1D
                                                                                                                                                                                                                          SHA-512:28CED26C8ACBE9177FF01FB24D7A8ABB34F37A0748824508F86A75B162F17371F02318EEAE4F27ED183143A22AF01C57D074F3B444621209D573AA323071C7F3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................]..Q............n............................................Rich...................PE..d.....ee.........."..........N.......................................................V..........................................................<............`.......6..XR...........................................................................................text...?........................... ..h.rdata..............................@..H.data...H0... ......................@....pdata..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt_old.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):86792
                                                                                                                                                                                                                          Entropy (8bit):6.888349837966484
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:Ibd83hVT3hyznvF7GdZoI20ePPHKi3/m8WsHwHHbkoE9y1PxmUKP0D:q63hB4znvdG3oI20eF3/mBsQH789uxmC
                                                                                                                                                                                                                          MD5:E855E9039F37523E6B01E05107CEFEFF
                                                                                                                                                                                                                          SHA1:C0882DA58826DE9FB9BC95C929A73FB71735FD78
                                                                                                                                                                                                                          SHA-256:3B81711731E79EA45C3545B599F3EBC21CED95F608694332892C918E6B2FAA17
                                                                                                                                                                                                                          SHA-512:C3C56EC6A31F9C0A49B195B2E503659C61B47CF556747EBAFFE6FB9F8880A8BEBAE84BA12A749AD0191087BD3E843ED99C1EC74F51744A3743705DBF46C9C325
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$............'".s.......N#Fw.;..wW.K...N}...J?,.<WM.^M.t'..An._.d..9...1.6U..VX....e.....;.A.J.d....../U.e;.9>1Au.F.9' .s....{W.......l.c1E..........................................................................................................................................................................................................................................................X..UX..UX..UX..U$..UQ.$U_..UQ."U\..UQ.4UH..UQ.#UY..UQ.&UY..URichX..U................PE..L... .c.....................H.......".......................................`..............................................P&..P....@..................pV...P..X.......................................@............................................text...h........................... ..h.rdata..<...........................@..H.data....*..........................@...PAGE............................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360AvFlt_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):85744
                                                                                                                                                                                                                          Entropy (8bit):6.884660853790976
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:uX7Z6EaDLE8sy+Xbbs4Br8PeSd8SWJRM8a7DbfCQk54ImVzjU3P0e:0N6EaDgQ+XbY4Br8PeSa5JRM8a7DbfCF
                                                                                                                                                                                                                          MD5:86D92FF1F211F9704D0A5EE744DC5C5E
                                                                                                                                                                                                                          SHA1:21120D96DA72B7A592DFDBE918E2DD8656F0CD2D
                                                                                                                                                                                                                          SHA-256:79EB282821AA728F0FDFDB07A1FBA273AF83768614E026BC8E371655E398BD50
                                                                                                                                                                                                                          SHA-512:B547EAA0B43CCF1AF913C94AC7831EDAF45D15428FD017D8F41CB8942156A453C381D4526A0B51F343093F854B4C5FDB716BDAA366101CE652CDEEB83F5DE2C9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$..........Q.Z..k.{U|.Z.[Cc.&.FV...&p....m......;d.#."$.I.rH.9C.......ks.-n.._..>o.b...q..B..(...,U+.U.,....hUGi1..}yp....#sv.|}.....ee._..........................................................................................................................................................................................................................................................X.UX.UX.UX.U&.UQ.$U_.UQ."U\.UQ.4UH.UQ.#UY.UQ.&UY.URichX.U................PE..L.....ee.....................H.......".......................................`......i+......................................P&..P....@..................XR...P..p.......................................@............................................text.............................. ..h.rdata..<...........................@..H.data....*..........................@...PAGE............................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360avflt64.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):100592
                                                                                                                                                                                                                          Entropy (8bit):6.592857038022857
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:PPzwDmyyTwGIfCWH0seX90ZbgOMw6t42RszQrtghXiCnBztcHqj4xmVzBGUhP0mD:P0DmsC8anO212A2XiCnVtcHeVGqP0mD
                                                                                                                                                                                                                          MD5:12426837392E278838D1501A5F324398
                                                                                                                                                                                                                          SHA1:3BE22DF43E2BCE3690C92188A76FA33A8A581D69
                                                                                                                                                                                                                          SHA-256:4FB3CFBF91BC27E867D8F58081FFD3BE361481E2270627825CDFD13EEF50EC1D
                                                                                                                                                                                                                          SHA-512:28CED26C8ACBE9177FF01FB24D7A8ABB34F37A0748824508F86A75B162F17371F02318EEAE4F27ED183143A22AF01C57D074F3B444621209D573AA323071C7F3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................]..Q............n............................................Rich...................PE..d.....ee.........."..........N.......................................................V..........................................................<............`.......6..XR...........................................................................................text...?........................... ..h.rdata..............................@..H.data...H0... ......................@....pdata..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360avflt64_old.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):101128
                                                                                                                                                                                                                          Entropy (8bit):6.617035595822576
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:J3a2wlbrRCh8HbzTwYoUzbCl9uxGaCP0Q:J3jwprRCGHXT/W9daXQ
                                                                                                                                                                                                                          MD5:F14D2B6D2D2028CA0851A604CD69C408
                                                                                                                                                                                                                          SHA1:54FB598AF2F9EC109973085322E5B79254856560
                                                                                                                                                                                                                          SHA-256:167B31798B2BEC91BB60EB64F50300A0C5E1605203349817754C6BE161A84539
                                                                                                                                                                                                                          SHA-512:9DDA7BA6C320F7DEC35BB118C792FA6C56EC5C32610F7D93776F4BBB0A031BE5A7394CBE8931608FAECE0A855A26E927B2FFFFCDB005BE6751E07ADD4F19B49B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$..........................................................................................................................................................................................................................................................................................................................................................................................................Q..............................................................Rich............................PE..d....s.c.........."..........N.......t..............................................!........................................................z..<............P.......4..pV...........................................................................................text............................... ..h.rdata..............................@..H.data...H0..........................@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360rp.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3472352
                                                                                                                                                                                                                          Entropy (8bit):6.6453688297109546
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:F1yxxfecVkCHgXezHFnNHRSlAuXcsgCOzor6kR4RLLhN47BDwsUn+PVGUtICh:+8eFNxigjkGNC1Gnw
                                                                                                                                                                                                                          MD5:777B3FACFA06F388F173C05A8CE26EBE
                                                                                                                                                                                                                          SHA1:71AA737D5AA09430D7879CF52313CB22B3C925EA
                                                                                                                                                                                                                          SHA-256:436C7E1265EEABC485A4D15FC6D385AAC72976B454ED3A12243D74D3D9C99FD5
                                                                                                                                                                                                                          SHA-512:AE2EED769528893D717E23CDD0E6A7A61BD97B64F7CABBBB16F32794342D8602B60C2F5829E407C35B0C5B22663AF7A28A2B3B91141F9772C1164CC4C132283F
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Yara Hits:
                                                                                                                                                                                                                          • Rule: JoeSecurity_EICAR, Description: Yara detected EICAR, Source: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\360rp.dll, Author: Joe Security
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7...7...7...Oa..7...el..7......7......7...7...4...x~..7...O}..7...Ok..6.......7...Ol..6...Oz..7...e|..7...Oy..7..Rich.7..........PE..L...}..a...........!......*...........#.......*...............................5......B5...@..........................K1.6.....1.......3.H.............4.H?....3.$.....*...............................................*.t............................text.....*.......*................. ..`.rdata.......*.......*.............@..@.data...p....P1......81.............@....rsrc...H.....3......>2.............@..@.reloc..`.....3.......2.............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\AVCheck.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):329184
                                                                                                                                                                                                                          Entropy (8bit):6.66599155219376
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:rdFCKJJeKF+vQfd6FsdGu5mTjyum9utd0T59a:rTCKTHF+vQfd6FsdGPTjyum9k2T59a
                                                                                                                                                                                                                          MD5:0FC2F13D9E0CFBD4903A77051348D16A
                                                                                                                                                                                                                          SHA1:C1DF2FE56CBD15271020E48751C39AB482F6EACA
                                                                                                                                                                                                                          SHA-256:7B79CA1EC9EA05D6549218AF8C646F8CB25C563E66D810CA8890340066CFF72B
                                                                                                                                                                                                                          SHA-512:6977514116A2FA2C0A884B46975CFA048D966448E493C1415467D6BE8719C6B40DB0181A861F9E0EF53AA90A3B04012E02E6AECB70230745C487355170416EFC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!..@...@...@...8...@...8...@.....@.....@...@..$@...8...@...8...@.......@...8...@..Rich.@..........................PE..L...^..a...........!................................................................P.....@.............................S....z..........................H?.......(.. ................................>..@............................................text............................... ..`.rdata..............................@..@.data....4..........................@....rsrc...............................@..@.reloc...).......*..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\FsrMgr.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):310848
                                                                                                                                                                                                                          Entropy (8bit):6.674114316794276
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:LL0Ddua7HiAuNhZRK3nRZ7FJx/Ts/qOrlTZcqyXhyW:LWPCAwhi3z7F7/Ts/qOB7HW
                                                                                                                                                                                                                          MD5:DCF6DEAAF591B1C43A18B3E2CBDB5145
                                                                                                                                                                                                                          SHA1:A33DE3CED30552A2753A19F639FE746D51455910
                                                                                                                                                                                                                          SHA-256:A6998B8150721996F9B2032A878C025B6D350BD584FFA383DBB58749426AC744
                                                                                                                                                                                                                          SHA-512:8D96872FCA5707F4B686C6A0893022CCEF14DE6D810229E52C3F41CEA62A64D33FB006E488F48E8036E9916B4ADA3C3E7B53CAF16A420B252B9D3A7270745E25
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........LF..-(..-(..-(.\b...-(..U...-(..U..@-(..U..-(...E..-(..-)..-(...S..-(..U...-(..U...-(......-(..U...-(.Rich.-(.........................PE..L....xP[...........!......................................................................@..........................<..b..../..........D................7.......&.....................................@...............P............................text...}........................... ..`.rdata..............................@..@.data...(Q...@... ...$..............@....rsrc...D............D..............@..@.reloc...7.......8...L..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\WhiteCache.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1503744
                                                                                                                                                                                                                          Entropy (8bit):6.120063729748596
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:6V++6Ru2put/xYRabo6u4pFhSgfAwekCYbHBvqz:m+Rdg6Rabpu4pGgoweOBvqz
                                                                                                                                                                                                                          MD5:C1C6BA99D732588FD19D8A18A6B7B31A
                                                                                                                                                                                                                          SHA1:51188CB320D5F54C0C7841F3591D9450FE71D24F
                                                                                                                                                                                                                          SHA-256:6446A80BB60506C851D020973CAF6A71FECB6D276BD4B6731A3ABFDC94D53CE6
                                                                                                                                                                                                                          SHA-512:000667AE45FD77FE4912DF13BD3E51902D2E796D491F1AD5BA78113D3FF50F42027278196EDEA941BA7F2CD41FBAE734452267C144FE0FDF9732500B15205E0E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J@ma.@ma.@ma.."..Bma.I...]ma.^?..Cma.g...Gma.g...Uma.@m`.Voa.vKk..ma.I....ma.I....ma.I...Ama.^?..Ama.I...Ama.Rich@ma.........................PE..L......S...........!.....t...@...............................................P......E^....@.............................c............ ...2..............h7...`......................................................|...........@....................text....r.......t.................. ..`.rdata..c............x..............@..@.data....7...........p..............@....idata..T>.......@...\..............@....didat..............................@....rsrc....2... ...4..................@..@.reloc..,....`......................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr1.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3508
                                                                                                                                                                                                                          Entropy (8bit):7.524060814519545
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:BuBt8B8RtdqSXWY4MIkIRi7V6H4MxEWPdEzduOf2O0ilaYnZ9JtRJLZIlQhXREzB:BItnrJmYxt6HIUErNDzzhE8W
                                                                                                                                                                                                                          MD5:54370E4D60827C8C5F1176D79231288E
                                                                                                                                                                                                                          SHA1:B853C9EE21C5656BB642125EB466C5C27AE0B77B
                                                                                                                                                                                                                          SHA-256:3B9BA923DF71B6C4378D1A47DBE910BCD82CC133A2B37F6BD35FB706DD2EF763
                                                                                                                                                                                                                          SHA-512:CA6DF6418C4CF9FE2C44BA7BF4429D864B31907613A37E6065C596824B454B59E48A52D9FD882961DFC2025D74086E78EBF8AF2192E9FEC3B89D6DC8E1173068
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.....J4/ ..~NB.8....W'.p.......^UzMu.......jB..'.c....9aA............T...{h..q.../...}"......a.kwmx..%.N..n...@0+..|.9....K.....g.................................................................................................................................................................................................................................................................................................................................................................................................e..g..W..F.....3h3p(..b......N..jW..e.'....e..y.^.X.R...(....Cb:#@..R.x4...u...n...?...^.......".R..<Ft..*./'.;&2.!.(p..I....b...r....k.zxjYr...n\..&.c{......._Z.k.....E)......q>..B.a..^...9.n...1_.jhrQ.I.`f/+S..[/N.....2.......#JU.lv....zU..C/........1jN;.o..6.K6...|..5+...T7.....EJS.g.^.G~|.C.J.&..X...7.6l.S. D..i.a..m?.E..WH..k.`...z.x2.W....2V....l..........j.L.....q..!.u.YadD.f...L..*...T.~x..U....'...C...4;...B....Q.)%.s..Z`.d.U.....Pw...rz..%<.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr4.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13108
                                                                                                                                                                                                                          Entropy (8bit):7.882115392166843
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:fZWzwsWhsgXKtQOH/Ttlg62rsAQfGL9PI59PefCV54zZ/ukFqnUYKdCQX7q:fcdWh1KtQoiIAC69P29PeqfYDFuPKd9q
                                                                                                                                                                                                                          MD5:BC43E8286498916CE3E987E126905C14
                                                                                                                                                                                                                          SHA1:78F90DC726D67026A1C7DD375243A966406C3188
                                                                                                                                                                                                                          SHA-256:838E0D6E4865C607CA0E5B8713B92CEA43C35F8A1FF818675D9FFE0C4D12C6D2
                                                                                                                                                                                                                          SHA-512:837D4CEF2612433CDB9F25CF71E8399824BFD7651D644284E6B67CBD5EA9C3C9CDAD86940435F07BFA1063A4C9CF502B6F03A6A1170F73FCE9EB1B5AD2E5287C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:........|.h....$*}~W:.9.rGZ.?....{...`?.b.....(D|....a~p.Q3.1.4..z.w.....<...^J.u....@......H.Oa..*.z..2...*T.gU...y.s@...t..7.k.................................................................................................................................................................................................................................................................................................................................................................................................. E@R.f}^...0BD0.u..4.^.....f..6...+.6....'p5..n...c...\.;.E...}G.@.N..d.xy....YB@.v....t..`?..&....ba4.a..p....U.7].Y....b.....!..e.d.q..*.....5........^p1Z...p.L3A.u.9*........Kww.Z...*...?.`?<.^/.$.@.F_.S.l.BI...$.-^..k..E.rj.S"....e'E...W......R.tQyW...K8.~.u.....~....}<...=sB..+.1...T..!.1F.AX..N#.wH....&...[..;..!..v.2.4...<L?.k....U....$S.p...$.....I.......W.........U.I...E..h..}....unC.o..U.7].Y....b....s.[.c.57..-.Z...q....0@f.!~F..8....{.6=0...p."

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr5.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13348
                                                                                                                                                                                                                          Entropy (8bit):7.900643972617733
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:WXz/C+IHqIIVw9gIY5kVp+GfC4h0yDmgB9wDUv30LS:WXzaKuoe+X4ObyT
                                                                                                                                                                                                                          MD5:ADE7BA4F3FAA34535FB44A0169822B17
                                                                                                                                                                                                                          SHA1:D3B800BDD06E4582CCD4BE296FAF344A41F2AA53
                                                                                                                                                                                                                          SHA-256:3376967F3B18B6F9D1C0BB6949FCCC300FB48AF8D34280A9F299C34F387CD3F2
                                                                                                                                                                                                                          SHA-512:96C39E57B09B0F0F5BA479C6E1A0A9CE0027AE9A709D5DE19DB6E2CC3D14AE8303C233A9A2921AB1BE53E3D3A23D3C29D145B8FDC7E4E5D5214341E2E586330B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:........($.....:.k..9....4e].Z....W.....I.{....;i.N`....X@......49.....#.*.gD.....{...Q.......i.O.w./Wvv>.T./D.{..R.?...../.7..c.................................................................................................................................................................................................................................................................................................................................................................................................Q&v.(.P..[.2Z.....W?..+S.m..M.e#[.?.zv.+.K..{.3..%1.H.Y..<X_.G...{..#.....B...Z..8.A....%......[!.-1......Q.z....*-.#..dHK.B.[.v....>.}C...L.........?....yk..X."...1O..a.Q9u.=N..ca....+..'..{.,..9i..ll.8.d...`..y.N$\$..%.^..GP@_#..@k...a...n......r.........rF....+.......=.V.[..z...b&;d/V.\.gi...2.....5...t57\qS.7<....H^..a5..V......C.L....Fp`&M.....4.I{....>.(......Vsh.3...O.....5....m..AN.}.....IS....C.C........^9..D...+..fW..}.V>.....c. ^..w ..6.N*%.f...;...6/

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr6.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13092
                                                                                                                                                                                                                          Entropy (8bit):7.880899868519554
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:nkzi6MBdoSlt2DUxk75KmAt2blVDXQSlrsF6N8:nmcBdrlrk75KxsldXxltO
                                                                                                                                                                                                                          MD5:833FC4F29CBD7CE03AAFF6AE53F1B4EC
                                                                                                                                                                                                                          SHA1:E2DCA87856F5B30E81456BCD3B35CF85F1B5AF2E
                                                                                                                                                                                                                          SHA-256:81EACDF339371B54831E37AED340287F80644FCF0A70748196119F4B02470E74
                                                                                                                                                                                                                          SHA-512:800389E935B405D360C51C43F08EB6FDA354345DC3269CED0E0365173A557300CF1D1224B96708B59E9B59DEC93F2E1875BAC09527FEB543682572B0A88A0BC3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.........`.K.?%..j..M".q......t..Q....A......l0.0.tCs.2p...A.....^Y=.|.k......F.i....1.h..K_*.X...Q.~.h.\X..@D..'O...4M..V.................................................................................................................................................................................................................................................................................................................................................................................................X'{.`.7;V.q..`....6..(e{..4(.9X+.M..^..t.........f.=.o.lm4_....?/*.I.;....d.<..,^....-i.J....b......0$|F+..f.._u......G.....[.j.?K.....r..>7.....T`.m...m.VRy......e..u..!yE.h.hB.}..0.Z!....Yk...[...k...'.U.Iy\nr.a..k.j:;..:.`<.\f. ...].....L/.b..G.K..<.Q".......w..K..[.:.....y'".V..OrXRg|.._..t.A.........n...}....^..=e..k.....)D..CJY....i..5....U..W.?8.#bu.6.N.K.:..'E.o9.....N.."G^%..#.g...[&.}..=...2......f.a.-.......KZ8a.... ..P.K..L.K.u.S..).`..i..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr7.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13332
                                                                                                                                                                                                                          Entropy (8bit):7.89924577411422
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:1cVv2wCKIBJv3p7vuopk2CDpeCKx430C/4X:C+vMp/4X
                                                                                                                                                                                                                          MD5:1F668A15F6455349489F171169F0E83D
                                                                                                                                                                                                                          SHA1:DA44166751E281F6F834F52FDF452CF5657CDC53
                                                                                                                                                                                                                          SHA-256:62F37B9EFDC58CDDF3536F46C341A42482E0D368E79A5CD18BFBBEA40A1CD4B8
                                                                                                                                                                                                                          SHA-512:856A3A0ADE0916B1408B1DBC2AA7C34563282653B77C66C6489922D019E5DB503689DF92D308FFDC114A792FDC624BC2377D67C772201D22DC908476EA46AFFA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....`RiCC.)ARx`.h..-.......f.....H...v...5.'.6.<.......)..!.$.1.....L..s.`../......C.j....i.s..v..S.I...y..Y.$.*Q.3>..R.............................................................................................................................................................................................................................................................................................................................................................................................................-E......QL.......:....4..9.9i..1gH5../.5...5Y..a.j.I.Y..k^"W..[S.{..h.x.`..Vh'l..eW..z.yy.Pv.$...&Cbv.O.(..k..#:.2.o......H...+.cw......`.W..F...J..T...k..m>....6...R..;t<....Dw.<z.......!.Z...u....9...x....%.>........-.I,'>1..a._".|..Z.^..n.U.\*....wl.F.1.M...k...M.8..u)`hZ..vdP...].. ....mAG-.L.m.$"k...../.M-.+.a....).t..U...D'.....=.ulB.%.j..o.pO...ZBN.._.....\h;.s..V...n......U....F.0.D...B.N..HgJ..d.9o..,.V.. .._.D.k.x..]._..x...bm.f6..vG~BN...e.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr8.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2676
                                                                                                                                                                                                                          Entropy (8bit):7.331897501691861
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rqrmbJfZPTb8Z7RX9ja0CXMtDo0vRCWSllmKU3KJZ0NxWAeE8OUeo:fdBPTYZ7l1a5ctD/7/suWAeECz
                                                                                                                                                                                                                          MD5:627329BA4494AD3A65C7046049D92D4D
                                                                                                                                                                                                                          SHA1:65472EDDC4295F2B0E3D8AE1F4041CF07E56CF73
                                                                                                                                                                                                                          SHA-256:6337DABCC3CEAF25CE29E135F4AD230C72B82DD10AFA60106F5AB1EC9D4B8A75
                                                                                                                                                                                                                          SHA-512:067596013704989EDCE44E4E64C86D553E4B8036F86755F7DB17C268C3D7C9F3D40CB8D988EF972A0B1BC86A73B10793E5B6C589FF2F2C11BBB0A84E33FBA680
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....`.$.... ...H..^...-."q.BMs......`X0...!..ohoyv!1NS^$..Oo....M......F....=Sc..S...... .G.1.'...,............C...,+GZ.h...................................................................................................................................................................................................................................................................................................................................................................................................%d.,9....b7...m..o..Y>T...I...t.bl&.....yL...N.s..o..%.p.....x.M........U...h8L.4...2...>u/...8..1'.j...*.p.@....n.f..0G@q..*........v..7....u..^..N.m1.<.z.<.....2|...R.:!.....]M.q...Vyp"....w.f.FA.|LW.....tr.;...(.3.A..".....Y`z^..S..-V.eW.:<.0......::....G0Q....'...e.0............Uqw}W.....p..O..,.A...=s..T.d.....*OFh.L&!...D.........._.9.%.....H.M....I.jn........'.)..H.r>0..6.G.DA(..Yx.]..R.&./...&A,..=f....qmH..i...l..R......|....A....^Lj+..v.,_

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\fr9.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2676
                                                                                                                                                                                                                          Entropy (8bit):7.31201603425239
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:Aaw8btgu6wbHaw4NBYR7dkSTMCNyDRbzJVyahU3v3ytSa4JWt0ig:7w8Zgzwz4fCmcXyZJPhOvNhJWmD
                                                                                                                                                                                                                          MD5:17742F92D26802EF790582E3EAA9C849
                                                                                                                                                                                                                          SHA1:D935D04B9C28B42C6E9CA31827837193EF433979
                                                                                                                                                                                                                          SHA-256:48F5AF0BA3F96B3A2CC8D8128930C9333A435C83F14481EDB4AB69F2B237BD61
                                                                                                                                                                                                                          SHA-512:90A6136F84245D3D375DE5739DDFAEB1AF21CDD5E1420AD4EB08422F1122BAEBE8785639607B503D118D82B143F6D876EB34D7BAE516EFC20930125AF901A664
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.......A..bX8....F[..<.V4r.p.lu..<.....e..p.fh.R..{...;...=;....*b..Ohn/d.. .?/.U.w.!..G...g<....*.M,...........m....-.`.ql.k.....................................................................................................................................................................................................................................................................................................................................................................................................0h.!v.0..;.3..J..=..c.L..E.?..},X1j.q.x.o...S....y..t....VYZ..[.=.!.Z()...G.$.b..`..4\.2..%....O.r.?J..JJ.)......n.....Q..L.#d.w#..|.6..7...)..w..E....%.V..=....@.{C......<,..v..ic.1.....b./..<...z.F'.........Q...-3.Q.-...S`..Z.p..b.8.....i..U.......W.}a.Cv..C8.c..b.$\.Ll..9F[....g..%3.....a.....hC/r....I.?..X.......aw..Q.2n.F..v....|..c..w@..D..>..I!...*.,t.KP.4..i.IK>M..)..t..UR....@R..3.......l...+b..&r........]..L..Zi.VI7....fL*.....`..3. ..a~...s..>..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\filemon\ptype.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3524
                                                                                                                                                                                                                          Entropy (8bit):7.4962239941841355
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:IIzUQ+v7GtkL4SNGfvCAL4wS/f6JfwLftqJqyScSedmi9f:IIzUQ+TGtkL4SEf6ALvS/AYL1IrScSeH
                                                                                                                                                                                                                          MD5:0EA4F7CD0EB4DA3FC36E6076D886E074
                                                                                                                                                                                                                          SHA1:72F9F3A09B7A9631B9F7A92E54D81856277F790C
                                                                                                                                                                                                                          SHA-256:3ACB8C2F6D48E8487332B5297623D571C745D5C573A7B4EF1CBAA51F6EA2547C
                                                                                                                                                                                                                          SHA-512:AD7C668919E89DD5B2DAFB2D5B98CF57C34ED316A415AFEF0FA41D2AEF553B5E1CEA202D82C312476B58965E218D249C8FE375908C658855B8A03B06F09867E9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....d...?.F...Y00.A..~.....hX.g)2...8.'..}.......p;l.7.[W.#..@.G-........)..,..g.a.Q...`e..Vmv..g..*.................2.%...v.:....................................................................................................................................................................................................................................................................................................................................................................................................EQ.....O.|.kA..)...?.-.H.H......Lx...(........r/...wG..JV...Q........ &..............-v..G/.0..v8-.O8.Tb.....v..".R.=.8.D. .bT....1m@..1..w...E..E.9..6..w...e.9.....H._O..!.......``.pNj.......~.....~.!....f!...i...Cf..9..k.S..fe..7..i....u...1.?._>.Y&.(;.J......<0>'7.D....(Ka.L.,.|..Fz.;....).gB.L....O}....R.Kt=..E...}{.|...../9.>...tM...on.).....r..1.8.6.*$.`.....t"...=S...........V.H..E........4..<Zcv..::y.=T."M9..Z.G...@s.............$aJK.M"...+...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):147520
                                                                                                                                                                                                                          Entropy (8bit):5.074474910560451
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:zvSRoqgsYJEtzFkzF/pQ4SHL/x7wjyxSGcw6F0+z8QmCIpFPqop7R3kYAIxLuR5a:pEh
                                                                                                                                                                                                                          MD5:6C67671145297554AC805FCB9B4609C2
                                                                                                                                                                                                                          SHA1:3C7014FF5C11C7EB1803076BEC304D8B7E151BD9
                                                                                                                                                                                                                          SHA-256:6F184DF577264F0BFEBE7B8389845C211DE85BA9D938BFE5C2DA415EC235BAC9
                                                                                                                                                                                                                          SHA-512:DB1219FDD1A4A741F49DF86F78082973E90E5D4C2441B43E4C0552D72EB710F65FDB970F3ED9DB7787AD879001E2D13775087CE7048D033C1F5AF1291405C0E0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L...n..[...........!.....d..........B........................................@......m#....@....................................(........d...............7...0...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc....d.......f..................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with very long lines (337), with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1874
                                                                                                                                                                                                                          Entropy (8bit):3.601394508953335
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uLTRVYxg8Ux8iEQgoB9L73GnduthNbGY7IfcuqeMY7ecBkvA:r3LTRVYxjUxHrv2uNyY7mbqX8UA
                                                                                                                                                                                                                          MD5:084ED4DB701833ED8087E95588FB53B4
                                                                                                                                                                                                                          SHA1:3C036468729730958D7A1788194CAAFE0BBC92F2
                                                                                                                                                                                                                          SHA-256:59966FE1163B45FA6E13CED9B48DCCA71E6E868E6679544965D02925F77405DB
                                                                                                                                                                                                                          SHA-512:AFBB6E71E905EA3119A1E510C88EE1394A567642995D47AAD5561DAD86E2FEA85B7565510DF97E7D7DD3F5A36C265FAEAC4B4884E23C6D0B23C63CFE85202797
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y. .F.e.h.l.e.r.b.e.r.i.c.h.t.....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=.i.s.t. .a.u.f. .e.i.n. .s.c.h.w.e.r.w.i.e.g.e.n.d.e.s. .P.r.o.b.l.e.m. .g.e.s.t.o...e.n.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=.W.i.r. .b.e.d.a.u.e.r.n. .d.i.e. .d.a.m.i.t. .v.e.r.b.u.n.d.e.n.e.n. .U.n.a.n.n.e.h.m.l.i.c.h.k.e.i.t.e.n.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=.B.e.i. .d.e.m. .P.r.o.g.r.a.m.m.,. .d.a.s. .S.i.e. .v.e.r.w.e.n.d.e.n.,. .i.s.t. .e.i.n. .F.e.h.l.e.r. .a.u.f.g.e.t.r.e.t.e.n.,. .u.n.d. .e.s. .m.u.s.s. .g.e.s.c.h.l.o.s.s.e.n. .w.e.r.d.e.n... .W.i.r. .h.o.f.f.e.n.,. .S.i.e. .k...n.n.e.n. .d.i.e.s.e. .I.n.f.o.r.m.a.t.i.o.n.e.n. .a.n. .u.n.s.e.r.e. .W.e.b.s.i.t.e. .s.e.n.d.e.n.,. .d.a.m.i.t. .w.i.r. .u.n.s.e.r.e. .Q.u.a.l.i.t...t. .v.e.r.b.e.s.s.e.r.n. .k...n.n.e.n... .W.i.r. .s.e.n.d.e.n. .n.u.r. .I.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\LibSDI.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):104572
                                                                                                                                                                                                                          Entropy (8bit):7.998241568255737
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:2mQ+76bmOrXULt90yy3FWc19fZ6lLbx4l:q+EuOt0c13Obx+
                                                                                                                                                                                                                          MD5:719741BA3500D9506081A326D44F1847
                                                                                                                                                                                                                          SHA1:B79EC34280EEE8AD0364DACE70368AE9DADC74A5
                                                                                                                                                                                                                          SHA-256:4D173FDFCA7922FF9D4849013AA49535A34087C72FEADF2C9E1DABE0CBCD0AFA
                                                                                                                                                                                                                          SHA-512:19966E933E723E1E3CFCBBBC9908FED12890CD0E6CC9AEB2FE4C57DB2E1A2E5B0F3A075140360A985D966185F94B77B4261C3297D01FF59DC0A9B6CAFDC1488A
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.<.'z.[......w,..C.........C..*i...).!...\..+.X9.g.....$3..'J.*V..$...9.m.....QgW......6.7gy.ta..F$..9..2.7y{..7..w.'S..L#..~jt@.G.....#.Lq.r.W..'....q.U...s9..S5.~..S....C.gU.Mp.K....m.....<v..?.......6...Dy;T.NO.cJ...v{...RZ..p.*.L...l<.........e../.9.H..KhDGtMZ.MD@...<...D.`......e..]...<..$.g&{u.oK.N...3]@...D(C..T7......Ny.....C.?.^...........s.|qS.....U.....E.......a.Xrw-h.....PK.R.J%+.p..y.3'...hc.}m..2.0zT.D8..Y..>u...!.....G/...f.n..=.O.s..).......a...t........5..?+. ..G.....}.....j.......N!....L....xZfl..".......;>|.J...?.._..........i.>.kGS..........m....!......t......N.....s...q.......c.jc.{X ..l.l.....U......x.a..\f.g.Lc......g|._r....|m.....>....U.<.C.t..=.y..`$.U....[q.\.y^..........IZ.Tb.......e,.O....xd......c...&;....?..h.[....M....4_.APS..).Z...:$.*PUw.8j......{+H..1...[.....'....o$Z..\.."..[.. .%.M.jr.*.......Ua......Z.g....Wp<K...\...PXv...@......~..6.xB...&..t...&V....d5......^.p3.L.-.kw.....X....e.y.8_....7.=l.h}.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.5900373149303055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7g7tGItDGiSmwUI7nOSeMOTjrA8nQJ+MQ3Voy:s7tjDGiSvKrAnJeL
                                                                                                                                                                                                                          MD5:77196BB0AC87B04B8018A3ACD42B4B0E
                                                                                                                                                                                                                          SHA1:19AF954E7C1ED4D40D6B0A3CAC507A51611A2AC5
                                                                                                                                                                                                                          SHA-256:60AC2F8F4E204A8324CD5B90B939C913AFA8A770BB73F3D878B645529E4A3FF7
                                                                                                                                                                                                                          SHA-512:AA4D1490C83AB6232FCC1D3B7556BB88CF3306FABB5664D48C7B42F3A56314CE5EAC0B8DF5225B3438ED38CF423C8D7FE469B50E58E7D6A69E8D43260DD5A51D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...[;.[...........!.........................................................@.......A....@.......................................... ............... ...7...........................................................................................rdata..y...........................@..@.rsrc........ ......................@..@............[;.[........]...........RSDS...G.@\A.m..........C:\vmagent_new\bin\joblist\258920\out\Release\de\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):118840
                                                                                                                                                                                                                          Entropy (8bit):5.356708209772258
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:C8VRo8a0XNRYl6nEEEPi/eBP3RjvxCCT8utT/n/jVsOZFJNF0MfMY3QT9myImXLa:FS9
                                                                                                                                                                                                                          MD5:255DF9FD4246A6451068AB834EC0C14B
                                                                                                                                                                                                                          SHA1:C45295342FAB41190176D9FE9CAD4ECD1F5CA3E0
                                                                                                                                                                                                                          SHA-256:1CCE6EE6CA9F26A298A8BBB0AABEFB8E7D76DD1C6D67C116D8B207DCE0F0565A
                                                                                                                                                                                                                          SHA-512:95B2787EDD3DF122F78D77EC721B29A2106EF7DB7AAA25D666E616B9051C48D599FBD613E8558A5544FA3B8394D763BA295E51C9ED768CD521E2718FA2AAC43A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d...*......B.....................................................@....................................(........................;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111704
                                                                                                                                                                                                                          Entropy (8bit):5.169721784492941
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:rlpKFRooWJkkynEEEPi/eBPnRjvxPCm8utT/n/aVsOZFJNFBMfMY3li9myImXLMm:5Ej2
                                                                                                                                                                                                                          MD5:273C1645B790459B4DBF83FB9B2FAB2F
                                                                                                                                                                                                                          SHA1:3AB8D81CA2516A2838E43878D3BB3162E90B537A
                                                                                                                                                                                                                          SHA-256:1F319D71B2A51621C4BDEFA1E5A4962BEE04545A28E691C61B7A8EAC24FD67A1
                                                                                                                                                                                                                          SHA-512:39B2C46929521DB6930B665E360C36AF75FDEE903E8BA13DFDEC5FA6C197637F1D818CD50F7A5AD41875467F081E5E4FB3B8D532B596164643FE0FA72C8FEC89
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L.....-V...........!.....d...6......B.....................................................@....................................(.......8........................... ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):95800
                                                                                                                                                                                                                          Entropy (8bit):5.696047144219386
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:cmvblAch7S4RovnEEEPi/eBP3RjBNxCCT8utT/n/jVsOZFJNF0MfMY3QT9myImXx:cJ4RovnEEEPi/eBP3RjvxCCT8utT/n/3
                                                                                                                                                                                                                          MD5:76BD17524F16FC1D284DD3CFFE60B8C3
                                                                                                                                                                                                                          SHA1:F46142DBCC64E79881A7834B17CAE0B882C289C7
                                                                                                                                                                                                                          SHA-256:A5A6A83FC134EB64DAC2852A9CC5A965B83C724B0BD56FCC123A7DBCFB6B4385
                                                                                                                                                                                                                          SHA-512:E08909619B0C402D4686C9FFB94F7D89299256FA9D4CAEAA925483B8DE3292B3E9270E72F804B5A1D42A3CE9E5724E5EA5742174AC78075B220BD747C9AE7BD2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................p............@....................................(...................:...;...`...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc..............................@..@.reloc.......`.......*..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\deepscan\dsconz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19085
                                                                                                                                                                                                                          Entropy (8bit):7.990470345422254
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:384:3AG4SpbwEKYAbje8a66SbGYQoYtIglDTuREcPJEB9Y3kbdoKbSYp:fbSj0SbDQoYZlDT9cPJEB9Y8r
                                                                                                                                                                                                                          MD5:523C60AC44A5E4E4021A696B8C1CD10E
                                                                                                                                                                                                                          SHA1:E3E6B47ACD392A46748542D8562A9BF42859E8BE
                                                                                                                                                                                                                          SHA-256:9A298070F9577752E2149E1D3C82F794AF0ABA4F4476E991F9D53B978A6E7F11
                                                                                                                                                                                                                          SHA-512:61704071C92C4FE327F5FF20BCC2CBD39C95EDBEFB6CB54BB90792108D8B1FAB1F4D835B6499464BBCBF4569BFE122BFFAC8314684D03C1ECAC6458C30E9B305
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............QJ....i.M.. ..v........L................LLLD..HLLLLLLRLEL.... ..{.....5lG..]jo.{[T....._.... ...B.+C.|..D^..H..R`.I[...BM....9.~.x.N31...pK...U.O..''z...w...XA...P...5X..nP..$.DdP<VdF.`d.V...&....h.y.b]7..P}...~..3..3...[c....1..s...[............j.....P.v...i.H.t......d.4.Q.V.KJ%......q....j+.3...b.i..[.....8...Sdy.....L81Dw5.9.%...9...5..!yk..H.IV...6.q.VW..G.3{&)E..{. ..v|K$.....E.gC@a...<t.....cy.4...~..r.$bH.Y...L...F..gN..O....6p..We..N...r{.9..;=.%..O..%]=..J.Y=#...//U.=>...F......G^........p.........c%.a.I#...G...8..8.or......!....o.S..6...L......1.c..CM.m...R.^.[:.@.0..6.j.v..A..#.&..+-..C...E.}./T...>...F......C..A...<^k.{Q,.2xaU...C%%U..m.....<....D....@.~.p......D...=JJ..q.G@...It...TI...?~.._._%5...L......ns.Y..k.....g..............XW7..CzZ9....ce@..M.....d...H9qB..J.%.......t...(.t.....5.i.2h).jK[.B3.\U.hW...aR.....sN.>..B.I:...n...3.U'.3.2.&......%-...dSM.,.Zx0..G7....myc....l...,.=.;d..f..l..|...!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60653
                                                                                                                                                                                                                          Entropy (8bit):5.400868957584662
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:iAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAu:qM4A6UAHRHF4aIkBPwf
                                                                                                                                                                                                                          MD5:98A81DC239A8A0EE6A9F35B70F03AF50
                                                                                                                                                                                                                          SHA1:87B71EE293C8670D0B996CE0BFB3C3186679B483
                                                                                                                                                                                                                          SHA-256:36C3286B5A7BB431A33B19F3ECAC3E80EF15FD8015AED1ABF9F38E3CC06D270A
                                                                                                                                                                                                                          SHA-512:6A086632326BF3BB3ADDCF34576240F897AD8EDFF04F957F1721825DC78BD755598801193EC7FB3338C2A82208F3007D7559BB6DAD6ABEE00ECC73A09AA5B288
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<....................i..................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):26176
                                                                                                                                                                                                                          Entropy (8bit):6.269831858348317
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7LtPSA+QssYf/5RcOfI76eR3KJ1M/ODGPhCZUQKvrfpMQ3/k:XtPSA+QssYf/5RcJb9KvM/ODGpQwJk
                                                                                                                                                                                                                          MD5:711C78E327A1F01624DEC99C918A1F55
                                                                                                                                                                                                                          SHA1:5E0B00E66D15A8E0433E41510A2C7607B2F2CA19
                                                                                                                                                                                                                          SHA-256:9618B5C24C267963277831D4C410E7CB6D627550B06E186E54B525C248BDE3B9
                                                                                                                                                                                                                          SHA-512:591EC5BEA1D755E7F5AFE4453C839E3BAAE8E86C11B06391FCB4118E6A0E8B10CD3A68D5E0EB1C254558F575934EA5EE39E4603F284C4868F5874636E96432B4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........*...............................................P.......y....@.......................................... ..$'...............7...........................................................................................rdata..y...........................@..@.rsrc...$'... ...(..................@..@............. ._........]...........RSDS.:#.!9.H.=.!nk......C:\vmagent_new\bin\joblist\503376\out\Release\de\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49272
                                                                                                                                                                                                                          Entropy (8bit):6.35682629477174
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:HSWFluWFrLpAEl60h7l61H601/O+6JWK0gdvyBB1j1:yWPrlAMh74r/oJWK0gdvyBBR1
                                                                                                                                                                                                                          MD5:DA00E0EC3E5501A5ECEC686CE558753F
                                                                                                                                                                                                                          SHA1:C43AF3A6A2BA5856B9724B38CF3DAF5CF757F754
                                                                                                                                                                                                                          SHA-256:1A0608428FA5AFCECA1156630C56325605A01289ABF83E96292AF1C9C096E6D7
                                                                                                                                                                                                                          SHA-512:EA2596C6527FE9DFC310E2C7D520DE986AB2FBB9AB607737254FBD804FD403A53C5022386278AC2EC6D8701C15165FF50B3D1EDB8A6F813498522CAB7D2C39C9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...A..U...........!.....d...@......B.....................................................@....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49272
                                                                                                                                                                                                                          Entropy (8bit):6.358284860272868
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:kSWFluWFrLpAEl60h7l61H+01hO+6JWa0ZrteBDG5:hWPrlAMh74nhoJWa0ZrteBDG5
                                                                                                                                                                                                                          MD5:5A06D1D04601AD5DA6EF42A324245B88
                                                                                                                                                                                                                          SHA1:4021319FA27843FBF1D53D04BC64F71BF1979E95
                                                                                                                                                                                                                          SHA-256:E11E6999B0F0E8562544E87A53AACF2E975D00AC0F9D06EEFE73FE0853614AA8
                                                                                                                                                                                                                          SHA-512:8C26683792C1ED59690CA337E46DD869FE747F1F46A0342A9F55C1A7B175F72DB8133CF383631D30D6B8E2B9FD0F5296C8E78DF03BF9ECD750772ACD9829D991
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...i..U...........!.....d...@......B...............................................c.....@....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20960
                                                                                                                                                                                                                          Entropy (8bit):6.331622727173707
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:75ugaRqRihKVpR9SCW1y/cj6ki2cP0iwfLg2p1S+ShjmM6IGBkSyJ1:9ugRihKVpRLW1yUu2cPfwH7S+ST6nkR1
                                                                                                                                                                                                                          MD5:6A9107DA93CC8419D8D8EA79C2896D4D
                                                                                                                                                                                                                          SHA1:9D7DBF39E08631E19066A9A4B94C952DDCA44C99
                                                                                                                                                                                                                          SHA-256:ED1D3569ED30A63C6059E7D644AEE2AD91CCB6A715B4241EC34D86833E83B6D8
                                                                                                                                                                                                                          SHA-512:BA70394E35CD837F5A5037EA65D5EF1EA8962D7F2A530D3F3BC2882CE21049AD6CC1F844FF07451FF0D693B7762E3C96CAE1103DB0D0D265624F065C97C81AD0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........$...............................................P.......c....@.......................................... ...!...........(..H)...........................................................................................rdata..r...........................@..@.rsrc....!... ..."..................@..@.............#pf........V...........RSDS.".wH..A...O........C:\vmagent_new\bin\joblist\815456\out\Release\de\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19936
                                                                                                                                                                                                                          Entropy (8bit):6.493855138140725
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7BMuQg/+9l5BjZH2p6ki2cP0iwfL6ymI+S+ShjmM6IGBkSz:auQgmxBjZWM2cPfw9mFS+ST6nkw
                                                                                                                                                                                                                          MD5:A96A2896D4BC77EECBDCF3A12DA6BC0E
                                                                                                                                                                                                                          SHA1:F511A75D41AEE68F3E820FDD40AF7512BA2665E7
                                                                                                                                                                                                                          SHA-256:646B1E35709CA419B67C66553BEE219EBEFD840358440FC7A1559657F0BB05A4
                                                                                                                                                                                                                          SHA-512:6256B652AA15F3A52070EC3341F556FCD23A032B1331653E042C355321B4553BFB051A15ABCA653911BECEA9938EC672E191844137A2F5C32BD4A864F86FA2BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!......... ...............................................@......+z....@.......................................... ...............$..H)...........................................................................................rdata..u...........................@..@.rsrc........ ......................@..@.............#pf........Y...........RSDS...!.-.A.R....xq....C:\vmagent_new\bin\joblist\815457\out\Release\de\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.968514351588424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:5vHP8qNfXOKM5VHblx1qhvmVqC7exscB3neUvESwTPprqWPQTUDnwENL1c:hHP8KX5M5VHRivmsCescReUsZPqid8
                                                                                                                                                                                                                          MD5:BD29091BA65B3FC08C79654997B4C82B
                                                                                                                                                                                                                          SHA1:3B353EC41DCC96D898715F6474656F13931C1B61
                                                                                                                                                                                                                          SHA-256:A3CFC3C8F95F0ED56306D28AC87408F10875C43BCA7778C6E1CC18C7A3441183
                                                                                                                                                                                                                          SHA-512:AE64DAE0E4025968BFB14E57C2FAAB0C9DA39943DAE9C884CBBD940433B29613C090B98899DB847C94B265F969A6ED3CFEBFF35AF284CA9619E6E25937067650
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................A..a,.@.-_...#.....2..vI...^..2..H"..........yU.;.i[..{.~:p.u.!...&..JnZ.......)px...@-T......7.HK.)...Z...[@n,4..h.C.!....#..w%..w.`...0..$................0...............q.%H...CK.d.d.=\I...).../..UQ.9z..@.(..gc3v.... ..v..+......`f.~.z........o+..}..az............(-z......3.*..7>T8O...._='..P.hX.....Itvz...r~$.....r.3....L.e..H|. z>x!;C..J..a.=..c$.....6..6..._s~..b"-...!.fI.&....w.]b......+....b...U./..m.6[.o.DS...=>..._C8.Av..yy.^*Sh-.s..Z......w\.n.;...q..h..Q.....<..V.........t.....4.6..F..=Q*..........0B..h.ja..=......|..>dz.,.)......&.......3..|..;]"q..A......R.y{.......$.d.L.:.......]j...G./<mFJ.!.,Lc.....Fcvw..{4.SH.*..m..l..|.?`N=d.l....O..y~....u9..?s....Jy..P

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32908
                                                                                                                                                                                                                          Entropy (8bit):7.98579519717503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:mqPy0zBxmlBLCxBIZuPVOWdT0bQUu9d2+8Pc1fCrGrP:m90nmlBLSBjt/T0MUu2ofCrY
                                                                                                                                                                                                                          MD5:F507C8DB8F8EC9361F36608408C9939E
                                                                                                                                                                                                                          SHA1:F3915EDB67FC281DDE5657B383E3A5AEDFE96BB8
                                                                                                                                                                                                                          SHA-256:DAB50E3C2787808BEEB0B377AD7C3DE2C518578B9F7A4EC4AC29063D59C00B3D
                                                                                                                                                                                                                          SHA-512:CB09E4F033B873211BFA8B8B82FA207EA5C176D8D686487C2253214F5F965734D2A16A04AE41B849FFA20B3B03814714274B749F07DBC28A0A5676A86630FEEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................r.e.g.m.o.n...d.a.t..............................................................................................................`1.!.../.C~.}.Q.i.{,..L......B.PG...xJ..L#.......B#.5J?.j}..f..`x.F.dG.p......."...VOn%.%M.D.;.F;.XL].o.S.DK....F[.....]....#..w%..w.`...0..d.6..............0..........X.6./).5.b..V..p,...u}".~..t...0...r..6,...c.....y..>.....lxh.t...O...-}~.c..1.'zv:..s..t^.|....%.."k.c....n.....J..x&. ._.-...\.9>.$.q.).~........v...b..IY.{...cp.f5..F.&..o.].V....0..J....w..f].%...!..\t.s+.J}....7.X..nI.z.M0...5...)x.8\G.._..w@.'..1....?=D.y.:Hw...9.@.Y.9.hd...$h^..I.G..gy..j.......5...nB.4 0!e..N...WQ.k....:x.9.`........3....38...W[..K1..{Q`..5P&z..8.J<.`.'+.i.y..0.a"Zu......KS......M..h...O..qbj..$../Z.M&...;...`..n.>..#.8. .m...|...s.$.K.T*c.....H.Z.S...P..5..#....^[.a=...........V.k..)r..%.i_.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):6.750153364400046
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:79MFB/paSij6ki2cP0iwfLsSkS+ShjmM6IGBkSpU:6/paSiu2cPfw6S+ST6nkd
                                                                                                                                                                                                                          MD5:9082B344847F0B625520C83F5DBD55E6
                                                                                                                                                                                                                          SHA1:A9840BD86621CC4F41B833E4101A2C321CF881CF
                                                                                                                                                                                                                          SHA-256:7A3F6DD2B2770335FD1E89618C191C4924F355443EA15D5050B87DB407024AC4
                                                                                                                                                                                                                          SHA-512:25033510662F8C30AAD87E3CB1C98B7E7D8608CA1C5B48E6D8D10BDBC900F794DA773E2089912A0ED4B87CDFBD08D8C59B22C7B220E218172521AA216ED8D9E2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...cfrf...........!.........................................................@.......}....@.......................................... ..................H)...........................................................................................rdata..t...........................@..@.rsrc........ ......................@..@............cfrf........X...........RSDSx.3....E...!./.l....C:\vmagent_new\bin\joblist\815994\out\Release\de\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1060, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1085440
                                                                                                                                                                                                                          Entropy (8bit):6.835012845151269
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:8MMOn6EdKHovLM23i70bvocIvebCDgHRKB8B3phmRLghNW:T67HOM23NbvocIvImgHuLv
                                                                                                                                                                                                                          MD5:0CB58560DC6E26FFF4D9AA4DA734DC8D
                                                                                                                                                                                                                          SHA1:5A1A55435077E39D753F96EE8A6452D90F7F8710
                                                                                                                                                                                                                          SHA-256:2D81642D556632355D8B57B50CE2092C57E9E17F6A97CD60D28ED1180731ADFA
                                                                                                                                                                                                                          SHA-512:C0BB927A8602DE02EA784A7E87D9218CA7F7C016D2DFB06579D834AD406DAFD26740012A79BD190FA084408A4158F669BB94C2424516EF64D71A55E807A2C401
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......$.................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 217, database pages 790, cookie 0x8, schema 1, UTF-8, version-valid-for 217
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):808960
                                                                                                                                                                                                                          Entropy (8bit):5.82619561707604
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:+/nCExkRpiJhfKNJhhD5PpS1t/PUPmuisxaA8Fnf7:ACExkRgJhfKNJLhctnUPmuTaAm
                                                                                                                                                                                                                          MD5:F186D371603B756BCB9B16F9905B83B4
                                                                                                                                                                                                                          SHA1:72AB2F3744AD7AF8B5154B1FB5EF80ED7DA9805C
                                                                                                                                                                                                                          SHA-256:4AB781FCD81C49CD50E0E9943B5FA34F6AEC6C38B007AFFEB29E8879AE2F80C9
                                                                                                                                                                                                                          SHA-512:5188937D4D07020046EA7768337E8F1527A9887F4EFBB7874ED27BB8C52CFD1130061276D47FE1D4AEA991521027AF725058577722248FC1322C81F9C7DEC7A8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.........................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):31864
                                                                                                                                                                                                                          Entropy (8bit):5.951762937655692
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7p4acsultAgwBAP3Excizfbi97k4RBM8z7eM8m:Ot4B23ESYfW97kSS4
                                                                                                                                                                                                                          MD5:EA7E6B53C0BD6E5EDFCFC836D121BF74
                                                                                                                                                                                                                          SHA1:B1EA730DD876AC93AE916F4F016F9B126E49EAE4
                                                                                                                                                                                                                          SHA-256:2A9774963E218C10CF93D573B04F41801C403A254346A5F6FA5E63198C427108
                                                                                                                                                                                                                          SHA-512:B279CD2E114DE5AC9E948BEB0ED9FA20AF7E0CB660AB62E0D4C8B131F52BFF150F7670A9CA1F21AE516963F805A03AA5816589707E4F80FA560E4DC0B063A850
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!.........b.......................................................\....@.......................................... ...^...........f...............................................................................................rdata..............................@..@.rsrc....^... ...`..................@..@...............U........y...........RSDSU.|].@.L.p..........D:\Projects\SafeGuardIntl\branches\SafeInt_V7.2_DE\i18n\I18N\SPTOOL\DE\Release\360SPTool.exe.pdb....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2176
                                                                                                                                                                                                                          Entropy (8bit):3.660286599489626
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uNyyTScYwx/NwOMITJEXenH4UnfUtKyc6fiP8iIG:r3NreJYpnc461iP
                                                                                                                                                                                                                          MD5:D9CC22869899744906100F7DAFD02E68
                                                                                                                                                                                                                          SHA1:0548C013D4E82EE54EB32BA7F947230C80CE04B0
                                                                                                                                                                                                                          SHA-256:8D8714137C4D05C68631C6A1EDBC600EFCE28591C5689AC5992B54D019ECF959
                                                                                                                                                                                                                          SHA-512:B6473FFFF29266AF5E7D82C0A69C1FE4C4E624A01A0EA50B42B0A778BD62C935E6220A9D5C497BA50ECBB4B3B7F2A56EA2BA95344A3EAC469A36143400D60E41
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=.E.i.n. .P.r.o.g.r.a.m.m.,. .d.a.s. .a.u.f. .I.h.r.e. .W.e.b.c.a.m. .z.u.g.r.e.i.f.t.....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=.E.i.n. .v.e.r.d...c.h.t.i.g.e.s. .P.r.o.g.r.a.m.m. .g.r.e.i.f.t. .a.u.f. .I.h.r.e. .W.e.b.c.a.m. .z.u.....I.D.S._.T.I.T.L.E._.R.E.D.=.T.r.o.j.a.n.e.r. .e.n.t.d.e.c.k.t.,. .d.e.r. .a.u.f. .I.h.r.e. .W.e.b.c.a.m. .z.u.g.r.e.i.f.t.....I.D.S._.N.O.T.E._.B.L.U.E.=.W.e.n.n. .S.i.e. .d.e.n. .Z.u.g.r.i.f.f. .a.u.f. .I.h.r.e. .W.e.b.c.a.m. .n.i.c.h.t. .s.e.l.b.s.t. .e.i.n.g.e.l.e.i.t.e.t. .h.a.b.e.n.,. .s.o.l.l.t.e.n. .S.i.e. .d.i.e.s.e. .s.p.e.r.r.e.n.......I.D.S._.N.O.T.E._.O.R.A.N.G.E.=.D.a.s. .v.e.r.d...c.h.t.i.g.e. .P.r.o.g.r.a.m.m.,. .d.a.s. .a.u.f. .I.h.r.e. .W.e.b.c.a.m. .z.u.g.r.e.i.f.t.,. .w.u.r.d.e. .e.r.k.a.n.n.t. .u.n.d. .a.b.g.e.f.a.n.g.e.n.......I.D.S._.N.O.T.E._.R.E.D.=.T.r.o.j.a.n.e.r.n.,. .V.i.r.e.n. .u.n.d. .s.c.h...d.l.i.c.h.e. .P.r.o.g.r.a.m.m.e.,. .d.i.e. .a.u.f. .I.h.r.e. .W.e.b.c.a.m. .z.u.g.r.e.i.f.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):109056
                                                                                                                                                                                                                          Entropy (8bit):5.360168507833317
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:rORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3Y:rOBrUC4jyUJGKzgSg+S5O8DFC
                                                                                                                                                                                                                          MD5:1F61944F692B8B77A6CBE1672647131D
                                                                                                                                                                                                                          SHA1:46410FF5700C4E3E17C9F4B8C8F0F6816B321A07
                                                                                                                                                                                                                          SHA-256:5185490C7766EB08ED8D250606C5D1C43E7C2AAFBA5EBA246FBE22EC5135728C
                                                                                                                                                                                                                          SHA-512:9B7F3D8E753D57877B25BF0C9CE9D95960ACC86E45CCF777640F934303F88A81903F5E5885D4088005C070FAAC299DD6DAC7AE26C4E8BC501287F05D5BFF0AE9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....e\...........!.........n.......................................................w....@..............................................l...........r..h7...........................................................................................rsrc....l.......n..................@..@....................................................................H.......................0.......H.......`.......x....................................................................................... .......8.......P.......................h...............................................................(.......@.......X.......p...................................`...........................................................................................................................(.......................8...................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):53368
                                                                                                                                                                                                                          Entropy (8bit):5.944613944552294
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:UXPO9QPgCg44/x9ezpnTNUTlt1GHXTpjq5VgPrfrNnzQs3o6eCv:IgCgZCpTN+lt1GHX9+zGrd0s3reCv
                                                                                                                                                                                                                          MD5:5803971D9D6CBDF366AA3C470DCAF38B
                                                                                                                                                                                                                          SHA1:3ABBACEFE307EDDA3FFED166E50FFE0C786DB5F2
                                                                                                                                                                                                                          SHA-256:78E8A90643E329A57718F038F7452832111F2E22907657ED05F015523C764EF9
                                                                                                                                                                                                                          SHA-512:2F1409B006703BB24B0EA7F2AEB083739312BD052A8681AB997CE285B3034CBB4902F9CB16FA5783B6151EC6E1A2CBF63C450D8FFEAA5A37E6BA7F52AA9FD45F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d......U.........." .....Z...Z............................................................@.....................................................(.......@...........................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...@...........................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22528
                                                                                                                                                                                                                          Entropy (8bit):6.683400334261787
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7sEyKrntbmkshtVku+pdhh2eryHU8/7X8r9ZCspE+TM4rLjtuGksy6BHUckAwdVU:7tLtiJI70HVJeM9+tHljXQKvrfpMQ3ua
                                                                                                                                                                                                                          MD5:617D9E328008405DC12F6C45A4772B77
                                                                                                                                                                                                                          SHA1:C5A7618AFB15A2437DBC71C6AD21BA6A431CB28C
                                                                                                                                                                                                                          SHA-256:68F17D14E94685882455A85289210409F8DF4D289E3B42277E73623F877B2EA9
                                                                                                                                                                                                                          SHA-512:946ADC4F85AED2BF81C499D058DCA2B7AB89343B4B5A87FE2A117427006851D3854029D8780F0178317BCFE744C2FD16011815E08E07CE091E3D9A4FA180D579
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....e\...........!.........................................................0............@.............................................`............ ..h7...........................................................................................rsrc...`...........................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...............................................................................................................................................................................................................................................(...8................................................!..D...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.106378057838429
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7qtEB608ZyI7nOSeMLjl8jRXoz2DDMQ3xp:SEB608ZZHjAdozkFp
                                                                                                                                                                                                                          MD5:CDFD0F5359532D12EB41AD95FE4E5873
                                                                                                                                                                                                                          SHA1:9866B620E84D47E9D9B2B649BD1031B3FFF9ED9D
                                                                                                                                                                                                                          SHA-256:E53391B1A15B6A336ECE7DE374E8EC510EEAD51FCE85CE5E4BE14937F60371E3
                                                                                                                                                                                                                          SHA-512:D402F4AC2FDDC1699214FBC7E2628977B3D959CABE2356A6A42ADB77457DD866E7199DB539488474356582F02E1685C08360924A8E6EDCF0A29C21FFC4E4D4F1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0.......V....@.......................................... ...................7...........................................................................................rdata..}...........................@..@.rsrc........ ......................@..@...............[........a...........RSDS...k._hA....L0V.....C:\vmagent_new\bin\joblist\259671\out\Release\de\UDiskScanEngine.dll.pdb............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19512
                                                                                                                                                                                                                          Entropy (8bit):6.968347013228531
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7O5yNeR3K+h1MeK6jvduRDGPhC7kov05MQ3:y5yg9K0MeKgFuRDGXo
                                                                                                                                                                                                                          MD5:CDEF616333132E2765AD18A6DEF0F1FB
                                                                                                                                                                                                                          SHA1:08AD38FF7A0BC96439039EBB8C49D9F6EF0B66E0
                                                                                                                                                                                                                          SHA-256:D1AD01C9B9683A9F5CC462B0931ED04557B3451106D0B0F405AA9234CB0A01EB
                                                                                                                                                                                                                          SHA-512:4BFEB1F883B42EFE15110880CBADC3CDC87D44BAEDDD3D296A92248756833F8FC5C76CCE4839AE730C81632D41FA986B495D004F3241DF1A2BD201A087BF2CBC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... .......M....@..............................................................;...........................................................................................rsrc...............................@..@....................................................................8.......P.......x...................................................................................................`... .......................8.......................P.......................h.......................x...............................................................................................................................,...............8...........T...............8...............................................0...Z.............I.D.D._.D.L.G.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54904
                                                                                                                                                                                                                          Entropy (8bit):6.213930174680228
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:7SWFluWFrLpAEl60h7l61HM01jO+6JWYznzQs3pBAGr:WWPrlAMh74xjoJWYT0s3pBAGr
                                                                                                                                                                                                                          MD5:EF7A618FEE40D27D9717DA512A734A18
                                                                                                                                                                                                                          SHA1:D6E641747BFDB9FAD40112B34CF41DCAAAAF090D
                                                                                                                                                                                                                          SHA-256:B82735C11F8972B545DC7148ECDD7FE372B4218AA41E07F6712A85AF6C141560
                                                                                                                                                                                                                          SHA-512:AA7096BFB82A93F0AD61C6E6928360DC65EE85CEDA4DB191DBCD645E30FD038362A03F6C3A516E3611C805907A64456F83E37826DA403FCBF00880AC154AC8D0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L......U...........!.....d...V......B.....................................................@....................................(.......@........................... ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc...@...........................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8824
                                                                                                                                                                                                                          Entropy (8bit):6.7655436879528565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:71hCMFo4yMrj1grjzR+vnr9ZCspE+TMArlD93WR:71wEIM8z7eMSWR
                                                                                                                                                                                                                          MD5:405320F9265CE74C502F5A92DC2735AF
                                                                                                                                                                                                                          SHA1:CEC2AA07EB5F073DC3D46C37BD7AE92C025075D8
                                                                                                                                                                                                                          SHA-256:DF2CB55FB96EC4CD6FFD717FEA63B33DB3D6B39B7B4244659E3BE3B1F34D8C19
                                                                                                                                                                                                                          SHA-512:1AC708EF9DC2EC1166894C65068CF19B58745236FD55CA10D1C7F8F1A9BD64E8A43FE52206E63925E42834FF0CF6C0EDC404582C1C5279B5E1598FB1EE3FEEFD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...>..U...........!......................................................... ............@..........................................................................................................................................................rsrc...............................@..@....................................................................(.......H.......`.......................x...............................................................................................................................................................................................`...........$...Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .b.r.o.w.s.e.r...M.i.c.r.o.s.o.f.t. .E.d.g.e. .b.r.o.w.s.e.r.......................................B.l.o.c.k.e.d.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8824
                                                                                                                                                                                                                          Entropy (8bit):6.763219600374099
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7qhCMHSyMrj1grjzR+vnr9ZCspE+TMAraT/:7qwWRM8z7eMB/
                                                                                                                                                                                                                          MD5:9EAC3D77855DE8F5E44B9C9D73315E3E
                                                                                                                                                                                                                          SHA1:CAE4AF4C47854612CEED912D6EA8417FB83C875C
                                                                                                                                                                                                                          SHA-256:0BB2157D09CE2BE9BF8FA1BDDFF86206F0265F92A26FD058F9DFAE1205C6819D
                                                                                                                                                                                                                          SHA-512:BA0F76D956D3EE388139C0D830EBACBDCDCA6DE1EFBF70D99F632AEEB77ABBE5AC650F2E242F6B6C238DAC9FBEA3A8811113D265F6A957146B1D1333251C0272
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d...L..U.........." ......................................................... ......&.....@..........................................................................................................................................................................rsrc...............................@..@....................................................(.......H.......`.......................x...............................................................................................................................................................................................`...........$...Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .b.r.o.w.s.e.r...M.i.c.r.o.s.o.f.t. .E.d.g.e. .b.r.o.w.s.e.r.......................................B.l.o.c.k.e.d.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):516
                                                                                                                                                                                                                          Entropy (8bit):3.6933526349083183
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Q++ubxj5Ovb0GQMqKyglRfdThR4g5TgEczDcE9SxE9soh:Q++uZ5Y2glR1FTcDtSYsoh
                                                                                                                                                                                                                          MD5:604A209087951685A2827CC455C4AE68
                                                                                                                                                                                                                          SHA1:4357573A052848C4820AE06B040BDD403E60CB36
                                                                                                                                                                                                                          SHA-256:C35150E66CBC23AA88BB2BA3878B8FD4CEB9EA51749497631862CD0CA3AA69F4
                                                                                                                                                                                                                          SHA-512:1D54A5B2B12C9EDCFD704268ED6FCE85D1DAF820B87C966A7605E2A77170F4600D38A16DB1B322911C5319AEF07930E1EA97B62859FFBF75337CFA982A0215E0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=.B.e.r.e.i.n.i.g.t.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.V.e.r.d...c.h.t.i.g.e. .D.a.t.e.i.e.n. .v.o.n. .U.-.d.i.s.k.....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=.B.e.r.e.i.n.i.g.t.:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=.W.i.e.d.e.r.h.e.r.s.t.e.l.l.e.n.....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.V.e.r.s.t.e.c.k.t.e.r. .U.S.B.-.L.a.u.f.w.e.r.k.s.o.r.d.n.e.r.....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=.W.i.e.d.e.r.h.e.r.g.e.s.t.e.l.l.t. .a.l.s.:.\.n.%.s.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8500
                                                                                                                                                                                                                          Entropy (8bit):3.557951484666829
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVl5ENqWIajuwapG4i8nc6WSbJ1J9Wd6AFWbmc:29+DgRgizMG4i8nxWHFWT
                                                                                                                                                                                                                          MD5:47383C910BEFF66E8AEF8A596359E068
                                                                                                                                                                                                                          SHA1:8EE1D273ECA30E3FA84B8A39837E3A396D1B8289
                                                                                                                                                                                                                          SHA-256:B0A2DD51D75609B452A16FB26138FB95545212EB6EFA274F2751EB74CCC5633F
                                                                                                                                                                                                                          SHA-512:3D307569452EC6D80056A3A2E0225D559606DEAB9A6C3913C1FEF7ED6ACA476D7A00190B1BBFA3D032411C2F52427F3096FCE7B7952479AD9B75AA3CEF59D7B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.336586080134502
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsAg6PCabR:r5u5/+mMks5qTp1mNqce9Oo/6aabR
                                                                                                                                                                                                                          MD5:005B503F13710659D0AA872406665010
                                                                                                                                                                                                                          SHA1:613562E702D6339F89F5A3D1A92D1A2719F63265
                                                                                                                                                                                                                          SHA-256:4E3A45C3657799DC91A1F1FFF7EA4E488C7E5065CD285DE6679D1DA0F30A6810
                                                                                                                                                                                                                          SHA-512:ECFB1942D0DDC4073F2A263A07382C002A999710E8B821EEC9951ADBA8D2F30BD9BE764DFE7C0A7B1420CCCE9F4E77193A21C39C0AC747749030B539CEDA396A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\de\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.688876612333752
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7TWDOE4emjfrmeKNQyMrj1grjzR+vnr9ZCspE+TMAr+Ps9p:7RDsJM8z7eMVs9p
                                                                                                                                                                                                                          MD5:C9D5D3932E653866E0CA41229A332D72
                                                                                                                                                                                                                          SHA1:F7244E11474B34B594F95E6BE9C456E21471D290
                                                                                                                                                                                                                          SHA-256:5BF78B6D3F24A9E66A3D3BEB226096B6AF9A733313432C9DEB27A53A6314D67E
                                                                                                                                                                                                                          SHA-512:2D18658AEC77E1981252C16167C33219D576C68F9A05C262B739C24B3FC33D1D4151C3B94C7CBD7A50AF4DB4C07BE99D562C814A4F4D3BB2363B1ED8513077F0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ............@..........................................................................................................................................................rsrc...............................@..@....................................................................(.......P.......h.......................................................................................................................................................................................(.......................8...H...8...........................d...................x...........t...Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.f.o.x.6.%.s. .b.e.i.m. .B.e.s.u.c.h. .v.o.n. .%.s. .a.b.g.e.f.a.n.g.e.n.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):129088
                                                                                                                                                                                                                          Entropy (8bit):5.233046956405083
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:ImvblAch7V7RotOM5vOob3v1XbtKvgVUglBBPOh3W1:I67RonUgVUgl+h3W1
                                                                                                                                                                                                                          MD5:3E5C2D008972836FC07E8A49B8BC237F
                                                                                                                                                                                                                          SHA1:93800EEF4F391C97A6EA4BCEE8603DF850F8A02B
                                                                                                                                                                                                                          SHA-256:A03C604691154E436EB21A7EB865C98BAF33B83AF18570A000EA31CE4BA844DF
                                                                                                                                                                                                                          SHA-512:6C6DB8BBE7EAFC2A063C77B8BA7EDA2A2AE87DCC98A997E290462E987EA3CE2872613D589272B823825BFDA87EA83251672FBD30E705289F74E13E0FCF99E3C3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L....H.[...........!.....d...V......B................................................\....@....................................(........................7.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1620
                                                                                                                                                                                                                          Entropy (8bit):3.6031033187099655
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uLTCVpKGkIKNabIfLY4Bw+iDHupA+JY7+YbqcUeBg:r3LTCVkG0BZBw+iDGA+JY7+aqPUg
                                                                                                                                                                                                                          MD5:880E5C62A78E5D11C9510F0A0482CB88
                                                                                                                                                                                                                          SHA1:E3B8B36176063545F3ECE610851C4418BCA6A55A
                                                                                                                                                                                                                          SHA-256:87C1DC55F5CD035C6D880D14158E0DBCD193D69CC331001EC456B5B8DFC1753F
                                                                                                                                                                                                                          SHA-512:30CA326A95A37873DCAB2F15EDF69FD80CB6D35FAC4501B23E3C8593634EABD0851AB33CF23BC16DFBEB83047DB30D9CACF57465AF564DBD97EB37E7ACA181B1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y. .E.r.r.o.r. .R.e.p.o.r.t.....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=.h.a.s. .e.n.c.o.u.n.t.e.r.e.d. .s.e.r.i.o.u.s. .p.r.o.b.l.e.m.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=.W.e.'.r.e. .s.o.r.r.y. .f.o.r. .a.n.y. .i.n.c.o.n.v.e.n.i.e.n.c.e. .c.a.u.s.e.d.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=.T.h.e. .p.r.o.g.r.a.m. .y.o.u.'.r.e. .u.s.i.n.g. .h.a.s. .e.r.r.o.r. .a.n.d. .n.e.e.d.s. .t.o. .b.e. .c.l.o.s.e.d... .W.e. .h.o.p.e. .y.o.u. .c.o.u.l.d. .s.e.n.d. .t.h.e.s.e. .i.n.f.o.r.m.a.t.i.o.n. .t.o. .o.u.r. .w.e.b.s.i.t.e. .t.o. .h.e.l.p. .u.s. .i.m.p.r.o.v.e. .o.u.r. .q.u.a.l.i.t.y... .W.e. .o.n.l.y. .s.e.n.d. .i.n.f.o.r.m.a.t.i.o.n. .w.i.t.h.i.n. .m.e.m.o.r.y. .a.n.d. .i.t. .d.o.e.s.n.'.t. .c.o.n.t.a.i.n. .a.n.y. .p.e.r.s.o.n.a.l. .i.n.f.o.r.m.a.t.i.o.n.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\LibSDI.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):116036
                                                                                                                                                                                                                          Entropy (8bit):7.998317027862222
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:jHUDSlMiffBSae95WGeDZk1FNtQL5HDrL9Qbd:jHUDixp/eLW1MLtWjn98d
                                                                                                                                                                                                                          MD5:552DBF3AF7B5615F2C7F5A0C64E03CA3
                                                                                                                                                                                                                          SHA1:A6773ABC443D8CE49C88C1554BD7A4196189C614
                                                                                                                                                                                                                          SHA-256:F511A0EEA52CB982C60EC2A8758007A8D83F8A36BB4B23B27E320CD9441862F2
                                                                                                                                                                                                                          SHA-512:64FBE41E296EF5D94CD76496623CFA4F49F0BCF1DA4F1A172320B81DC344DC94112D3465FCF1B4DF2166746CEC8484F2D2F1B2D238DC11EB82014B70EE31CE83
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:...=.[....X..'..|!..~.F...7Qp.p.=.8A`'`.|...,........X.....,.%.....9..f-.<t....n..ws.....2.K..LFJ6...wS...-.%.(........}....d t..y..;.kw.......R......L"...4.h...4..F..;.A...}T....q.M.Et.2o&.SPP..O..:.0.........].....w..Ft.A...~.M(, ...`.U'......e...H...W......C...)... %..mq.D.@...sL\;Gi6..%-?...pA.,@..D.'..U..=Aj.....OS..L!&..e5_J.....z..u9).N.4y...#w..#..C.......IF\X.....FP.-..{fdkW)6[!.*.z==_.i....sc...8.<u.../t..g.<p2.f.s.N..Y.w&:.9...J.m-Z.....)..!.........J....(._...Ee..,.G.}e...gu.....T.|......}(..t.._..[....".n.....).#...Ym> ..H....53-....{.^.../8...VO.....S.%.i.......Fe$...Y.Qg)e.;"]=.....T.Ac.w....$....B4.N.~9]\.|...b......Q.D.l(...R...J.`..g.cCJ..1`M(....3n..zng>.UV3..C..S..,.E..E.>.F.R...m@.{..\.ZH..a!j.|o..^.....v.m.#....'...OG..].....2...!....q.[%.B......4[.v.=?..`....0d....(.~.Tc...S.$.....4.......kt.sgvqp8v...........n...|0.......B]...$......&H.P....!.HhZH....(.......F.P.2\.....S.."[A%e.p....0...1.C..a........Wl..S..%..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.599239569030604
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7K5vtG1tDG87I7nOSeMCS5WjJoMA8nQJ+MQ3H9:e5vtkDG8kp50JoMAnJo9
                                                                                                                                                                                                                          MD5:627CBB9D1671CD7A553CB9E59E765BBF
                                                                                                                                                                                                                          SHA1:4A4916F14C4CA7D26DAC88FF4A5884761D8C5A70
                                                                                                                                                                                                                          SHA-256:063E660B1E32CBAEFB8B928F1FA638853BBCB6B996BB08496FC861FC5425A840
                                                                                                                                                                                                                          SHA-512:CFE0246353D9670AC7D77994633E8C55ACA4A3ECC889C52D09949E427D5E5E06056678DE15ECC3017AF81CA6CA1333F624F8652A7488DD4E317C6A46C8719237
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...N;.[...........!.........................................................@............@.......................................... ..D............ ...7...........................................................................................rdata..y...........................@..@.rsrc...D.... ......................@..@............N;.[........]...........RSDSg../U..O.#`..W.,....C:\vmagent_new\bin\joblist\258920\out\Release\en\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):109624
                                                                                                                                                                                                                          Entropy (8bit):5.4827748780264685
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:qy2lF/WFLLpAEl6Zh7laV5tg01jt1oMRobql4j/wWfZb/XFeoy5yFYECG5PgATST:D2kLlARh7c1Robe4bwYh5X26rBW9we
                                                                                                                                                                                                                          MD5:F81DFCFF6BFBC96256DDF60928C6D0CD
                                                                                                                                                                                                                          SHA1:89461F3C31C0DEDA19AB9129C510C1DCE31ABA37
                                                                                                                                                                                                                          SHA-256:E22F0B8132837E9F5F4C77AC8A9EA30C99CC88C2293D186B132012F9160DEFDF
                                                                                                                                                                                                                          SHA-512:BDE1B6169D67CC70D5EB5775B02E71C1978C5E63C0C7DB5ED0BAB3B6533FAA65ED4D27AB298E89FA17A6952798BAA6CFB6FB09AC90EA2E3FE72966A958F21784
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B...............................................'0....@....................................(.......h............p...;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...h...........................@..@.reloc...............`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67688
                                                                                                                                                                                                                          Entropy (8bit):4.746474657591871
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:2E4ul5xBj/wWfZb/XFeoy5yFYECG51gATSQPA3MQIGduv+Pocc3Q73whrm:tBbwYh3X27dI+wJQ7gha
                                                                                                                                                                                                                          MD5:B101AFDB6A10A8408347207A95EA827A
                                                                                                                                                                                                                          SHA1:BF9CDB457E2C3E6604C35BD93C6D819AC8034D55
                                                                                                                                                                                                                          SHA-256:41FC1D658E3D6795B701495D45E8D7BEF7D8CE770138044B34FBACAD08A617BE
                                                                                                                                                                                                                          SHA-512:CE24418045352557B5D0ED9EC71DB00D016938CD0FC2308E3BA0A61CD40EC0DF3A9B620E55D28724B509BAB3F801B7A88548B0B08B7D868A6046F85A49AAE910
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....)Z...........!.................................................................^....@.............................................T................5...........................................................................................rsrc...T...........................@..@....................................................................0.......8.......X.......p...................~.......x........................................... .......8.......P.......h...............................................................(.......@.......X.......p...............................................................0.......H.......`...................0...x...`.......................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):89144
                                                                                                                                                                                                                          Entropy (8bit):5.821641175757369
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:LimVVOWFbLpAEl6kh7lqFV4010woMRocEj/wWfZb/XFeoy5yFYECG5AaBPO1t9Ki:2mvblAch729Ro3bwYhaaBPot9we
                                                                                                                                                                                                                          MD5:C4BA560A993B0E6B25DF45D99A8C7F86
                                                                                                                                                                                                                          SHA1:0A6924E9B3008E3CFBE9C08F870FDBF49652AD61
                                                                                                                                                                                                                          SHA-256:11CDFC04ADCF8BD115D8C18EA5F1A4AC64288CBF007776EA25B357BB7BC0854E
                                                                                                                                                                                                                          SHA-512:4780B806DF951425850B3F5129ED3A99398F7DF9AA502E6CBB861BA74149A44BABB4606FC6BAD51703CA1DEF2BC4E2257A4605C057721695B6CF6C3EC3909513
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................P.......,....@....................................(........}........... ...;...@...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc....}.......~..................@..@.reloc..r....@......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60403
                                                                                                                                                                                                                          Entropy (8bit):5.392847591907253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:vAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAA:JM4A6UAHRHF4aImg
                                                                                                                                                                                                                          MD5:504461531300EFD4F029C41A83F8DF1D
                                                                                                                                                                                                                          SHA1:2466E76730121D154C913F76941B7F42EE73C7AE
                                                                                                                                                                                                                          SHA-256:4649EEDC3BAFD98C562D4D1710F44DE19E8E93E3638BC1566E1DA63D90CB04AD
                                                                                                                                                                                                                          SHA-512:F7DD16173120DBFE2DABEAB0C171D7D5868FD3107F13C2967183582FD23FD96C7EECA8107463A4084AD9F8560CD6447C35DC18B331FD3F748521518AC8E46632
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<.......................................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25152
                                                                                                                                                                                                                          Entropy (8bit):6.326201527087637
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7syVo1VK5ysI76eR3KJ1M81rDGPhCMov05MQ3d:nVAK5yTb9KvMcrDGroY
                                                                                                                                                                                                                          MD5:CD37F1DBEEF509B8B716794A8381B4F3
                                                                                                                                                                                                                          SHA1:3C343B99EC5AF396F3127D1C9D55FD5CFA099DCF
                                                                                                                                                                                                                          SHA-256:4D1A978E09C6DAFDCF8D1D315191A9FB8C0D2695E75C7B8650817D027008D1C1
                                                                                                                                                                                                                          SHA-512:178B73ED00BFD8241CC9191DBDD631AE28B5C7E76661863B326EFDE2DC2CB438716C0B70896EE313436CCD90F61DB5226A3484169176F5A4B79EAD1FB4451419
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........&...............................................P............@.......................................... ..x#...........*...7...........................................................................................rdata..y...........................@..@.rsrc...x#... ...$..................@..@............. ._........]...........RSDS2.O5m.{F..........C:\vmagent_new\bin\joblist\503376\out\Release\en\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49272
                                                                                                                                                                                                                          Entropy (8bit):6.359306772453438
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:5y2lF/WFLLpAEl6Zh7laV5tX01StY+6JWgdvmBV2M3:A2kLlARh7vPJWgdvmBV2m
                                                                                                                                                                                                                          MD5:3E88C42C6E9FA317102C1F875F73D549
                                                                                                                                                                                                                          SHA1:156820D9F3BF6B24C7D24330EB6EF73FE33C7F72
                                                                                                                                                                                                                          SHA-256:7E885136A20C3AB48CDEAD810381DCCB10761336A62908CE78FE7F7D397CDE0E
                                                                                                                                                                                                                          SHA-512:58341734FB0CF666DFE9032A52674A645306A93430EBB2C6E5AD987E66CE19C8A91F3FEEBF9BBA54B981D62127613DEC3C939EF4168054D124B855A511B6D59C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...a.U...........!.....d...@......B.....................................................@....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):47736
                                                                                                                                                                                                                          Entropy (8bit):6.053954085108329
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:VXHGdBPASgYoH6dzSnq5TmtzG3TpMtaTV2J8lAovrtd1tnQr:0ASgRcSqNmtzG39Mk5NAOrtLtna
                                                                                                                                                                                                                          MD5:DC4A1C5B62580028A908F63D712C4A99
                                                                                                                                                                                                                          SHA1:5856C971AD3FEBE92DF52DB7AADAAD1438994671
                                                                                                                                                                                                                          SHA-256:EE05002E64E561777EA43AC5B9857141DABB7C9EED007A0D57C30924F61AF91E
                                                                                                                                                                                                                          SHA-512:45DA43AC5B0321DDC5EC599818287BD87B7B6822C8DD6D790B5BBF1232000092AFA695774CD3D9C787919AD02CA9846F7200970E273A99BFBE2AA6BEBFE7E8ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...S.U.........." .....Z...D......................................................^.....@.................................................`...(...................................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20448
                                                                                                                                                                                                                          Entropy (8bit):6.434428355428392
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7dIRqwp/JNxmSRxyE5nIUb6ki2cP0iwfLBKyS+ShjmM6IGBkSEOV:e7yE5922cPfwnS+ST6nk3a
                                                                                                                                                                                                                          MD5:F584EFD5356E4A1BE69209A6A90F8DCA
                                                                                                                                                                                                                          SHA1:6AF86C8FA9C4EA0F28ECA735ACAD675CB32B7EC5
                                                                                                                                                                                                                          SHA-256:CDE2A0834CB8B6E4FABDA07F611567A392B2E4DC23F2FC7921F8B13E774DA940
                                                                                                                                                                                                                          SHA-512:97C02D900A05DBB2F5BA7CD33F53D4B5C67655D0DD11D6B1C374867570DD7CD5114DEB138DB277480FB45E608CCCF7542D76C4CCE7FB5C98356A5105B309BEBA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!........."...............................................@............@.......................................... ..t............&..H)...........................................................................................rdata..r...........................@..@.rsrc...t.... ... ..................@..@.............#pf........V...........RSDSy.~.6L.F.g."k.Z.....C:\vmagent_new\bin\joblist\815456\out\Release\en\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19424
                                                                                                                                                                                                                          Entropy (8bit):6.5527302391659905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:78I3ZhT+9lexj6sLU6ki2cP0iwfLaAS+ShjmM6IGBkSN:w7Gxj6af2cPfwJS+ST6nki
                                                                                                                                                                                                                          MD5:507A7B4E028D292BE4EDEDB6B3667E68
                                                                                                                                                                                                                          SHA1:752121FC2F4C4814A4C50BD6964C6237FBC69CD9
                                                                                                                                                                                                                          SHA-256:3EBFED2B2A10B33AF330AFF197905437EF3970E8C944B7970C097AC0CBB99671
                                                                                                                                                                                                                          SHA-512:0B1FB10521512426C448A85976AFE9E2E9C356768A5D2E941DE022C2194A487055C3C724C08DD4ABF1D115F24F80248CCD90A3655544DC17491F0373C603CFB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@............@.......................................... ..P............"..H)...........................................................................................rdata..u...........................@..@.rsrc...P.... ......................@..@.............#pf........Y...........RSDS.o...LF. a:.T......C:\vmagent_new\bin\joblist\815457\out\Release\en\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.968910229834047
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:FogdHMaU+kfGfHrEoD+j5k/IMrTJHVTod5jtgQOJ:XJK+/IeJ1TS5Zva
                                                                                                                                                                                                                          MD5:C1EE34D9FF3FB709EAC9B133C4312294
                                                                                                                                                                                                                          SHA1:2E1536A34CEBF71589AB8A44BF81D2584D27D615
                                                                                                                                                                                                                          SHA-256:CC01FF717B03D307C3914B7B03EE45C8FD67CCA072E2B76FA0A0E326F4E50EDE
                                                                                                                                                                                                                          SHA-512:206AD919A6CE6964619DC35D729E2F85B2BA6CACA4F664F5DA0F4D7FB762F6D8EA80D32F6DAB9486DC5F6FFAA7E1207797A8C86B324D346C82DEBE14D6D981B4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5.............................................o...................................................................f.i.l.e.m.o.n...d.a.t...........................................................................................................?.V.0I..@........$.d.f..\5..C...Vx..'..CBR}\..1&:y..*Jp..0.vr.{\..~z.%+*.7........S.g.F.}Y..[]..n;....k.D]...K.t..j..r.....#..w%..w.`...0................[..0...............q.%H...CK.d.d.=\I...).../....[..A.6.H.xH..".$...3c.Z...".N.,........U01....^C..9..B.O.OZ...C..)r..5..p..p...6.....?...k3....2..S.7.4Ha(X7."!".i%.....wp.@..Q1D..QH.tu.V.:w.....u..9z;.C..5*}C......M.~.q\..;.S..W=..?.G...>9.......P.m.......v..W..Dh....~...A...V!j.......`X`-.1...e......W.k....l4...}....z..@..P..R...T.....N(.w5....((....'eM..@..5.ou-.o..RkR.J..\b..t.].q.....y...x2...A..V...x..$5X....X(..K7.o..@..G..IS.........O....,.:yr..\G4..@[h9.iQ...y.g..Jw.....<i.Cnnu.d.........^...p......gX..`[0R.]

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32956
                                                                                                                                                                                                                          Entropy (8bit):7.98719878978599
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:aijpwssBpwQjVK9WlMMscqmWUUgAdHU/5K6wJ1szLgqtvrcTYAOi:DqXwn9fMsZmntiHUhyKkqtvG
                                                                                                                                                                                                                          MD5:487DA2F5D3D82B7B21B1408E75FC7B1E
                                                                                                                                                                                                                          SHA1:6010E94B831C889B9C408950DACD4E544880C9F6
                                                                                                                                                                                                                          SHA-256:2049AC1064855778AE9C3337C928052A612AEAF3542BCBB26741A8776E5081A8
                                                                                                                                                                                                                          SHA-512:2B8AD88CA181694870814B5CA713AE391B5941F12454BBC2BCAB1E1CE66FE9F157331926C09A220429AC98AB2C3A9B59A6CBCB4751330F2AA5933405DE93AF79
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5.............................................3J..................................................................r.e.g.m.o.n...d.a.t.............................................................................................................9....@.....N.H..... v+...H.jR...G....c.:.>u.m..7....@L....E. P)x.~K.O....Sp...M-$>i....^?.....Z.C....<..Ra8...;|%>.i]..D......#..w%..w.`...0*... .......(......0*...(....... ./).5.b..V..p,....P.CM..N...6..Q..4.....7..W.|.qG...O.o...r6.}q...M...dg.1EV.sB..............6.s.A.\...9nbP..z.o.....$.'\.B.....S7.I.q.$O.`.j.E....%h9"..-...+\E..Oc.N.r..0.4*.O......>...X.l..v..n.%;.}...1m.,..`..CUh_...~H.DKeed... ........$?.....apA.....wPi....~(.%......&..*b/.x..U...mi".>_.\E..[.(>.)S..c..`6...?..e..,......D..J....)A...=....m.....|.....?.+.se._..Y3......-]V.....U}.B......l.Yb_...'.r...... ]l.(f.8.7.......n..6..m)L]p..RJ.~.B......}.....U.]s.7..C...x...d&.t..2}.om..K.(NU."....+vj.d}..C..s....,f

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):6.818502996360454
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7p82Phneq2+m06ki2cP0iwfL46SIS+ShjmM6IGBkSvA:c+m/2cPfwHXS+ST6nkz
                                                                                                                                                                                                                          MD5:4F7FEBE3F590F61FBA281D6D48063AEC
                                                                                                                                                                                                                          SHA1:2A978CF218EE950728452E62A7E274F0F7B0F346
                                                                                                                                                                                                                          SHA-256:285B8717038589756ED43BBEFEC8D010FDFDA1B9726606332C1E3601CF6E43FF
                                                                                                                                                                                                                          SHA-512:55193636F87924A75E2EEECBCE50B19E7D1320698CDC58FEF62DCE807C0D462429D6A3034C2EB9E297012E67ADFB236DB91D05EDC4E3514A33017CD379AC3E15
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...cfrf...........!.........................................................@............@.......................................... ..................H)...........................................................................................rdata..t...........................@..@.rsrc........ ......................@..@............cfrf........X...........RSDS8Be.RAIL.Bmd...a....C:\vmagent_new\bin\joblist\815994\out\Release\en\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1059, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1084416
                                                                                                                                                                                                                          Entropy (8bit):6.837064845593466
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:LMMmJ6pODUATD23jo3sANYM9TWLrB8B3phpc0hbB:86EHD23asANYUTW5q
                                                                                                                                                                                                                          MD5:DDE9F4E1FD3C706361CDE23239BAF8E6
                                                                                                                                                                                                                          SHA1:646F69DEC3656FD19579606789D258FEF5A45E96
                                                                                                                                                                                                                          SHA-256:3D1B69B19A8510D6176CEB011B71D79859C13D4C61541EC7174F344D3A77BB24
                                                                                                                                                                                                                          SHA-512:536BAF039072C6E6FD1ECBECE3291C9B1C5EC01D8E41837BF285CF59015B1212A3283FE85B5D52D7A4BC16BADE883B6CCA3A94CE40788159A6545A6880CE7609
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......#.................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007009, page size 1024, file counter 221, database pages 790, cookie 0x8, schema 1, UTF-8, version-valid-for 221
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):808960
                                                                                                                                                                                                                          Entropy (8bit):5.825479215491082
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:c/nCExkRpiJhfKNJhhD5PpS1t/PUTmuisxaA8F5f7:mCExkRgJhfKNJLhctnUTmuTaAQ
                                                                                                                                                                                                                          MD5:E799B79B1FE826868265DCE4C8A6AC28
                                                                                                                                                                                                                          SHA1:44AF1A3FE155B4AC2DA06371A351D056441F409A
                                                                                                                                                                                                                          SHA-256:E00A185464266FDD988EDB2F4BD130B4EBDCE7E064FEDB45806F577F1BB19291
                                                                                                                                                                                                                          SHA-512:B740EB8C8B4A0B1D5D09DA0B3E4D65AB2611BFA83CC97A8B38E419FB9AE975E974738FBF4FB73406C8B3E473D2C092C46126AA6D9AA1525BAF41D632D5AE3E77
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.!.......................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32584
                                                                                                                                                                                                                          Entropy (8bit):6.027932340454107
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7baacsultAgwBAP3Excizfb5pei1QcMCPHz7eMKw8n:at4B23ESYf1Mi1+Hn
                                                                                                                                                                                                                          MD5:9259B466481A1AD9FEED18F6564A210B
                                                                                                                                                                                                                          SHA1:CEAAA84DAEAB6B488AAD65112E0C07B58AB21C4C
                                                                                                                                                                                                                          SHA-256:15164D3600ABD6B8F36AC9F686E965CFB2868025A01CDED4F7707B1AE5008964
                                                                                                                                                                                                                          SHA-512:B7B06367BA9AA0C52AC5CFC49D66E220232D5482B085287C43DE2EF8131F5EE703FFEB4D7BEF0E5D9A430C0146BB2AB69C36174982184A0C06E6BEDA14E808B5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....k.S...........!.........`...........................................................@.......................................... ...\...........d...............................................................................................rdata..q...........................@..@.rsrc....\... ...^..................@..@.............k.S........U...........RSDS,].s...N..bz........C:\SVN\Safe4.0\i18n\I18N\SPTOOL\EN\Release\360SPTool.exe.pdb........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1902
                                                                                                                                                                                                                          Entropy (8bit):3.636824758536452
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q++uNKxJWj3m/xJWjYJWjqLJWHIUR2L+m/xJWjPxm4YNIJWj5CW/qDtxJWwovMk4:r+uNKD5GatnnV/qJ/DgG8iII
                                                                                                                                                                                                                          MD5:FCCA8B86BB7C349FE6BD71D9273FD3DC
                                                                                                                                                                                                                          SHA1:AA7B1F48CBC86D2B1D0DF789CFF750A77E5597C0
                                                                                                                                                                                                                          SHA-256:6DE8913051A0281CDC1F485233B419D91AEDC1FA7428DAB04E6FC20CE1E56ABA
                                                                                                                                                                                                                          SHA-512:877938ADF8F20C978259305D482C27C7C8D7AB56897FD1A8F02C4A58C4B07F6D963A3B7C22681BCE90DE0FD7575EA06E2005E9197A76EA2B1A3FF70BB62AB1AA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=.A. .p.r.o.g.r.a.m. .a.c.c.e.s.s.i.n.g. .y.o.u.r. .w.e.b.c.a.m.....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=.A. .s.u.s.p.i.c.i.o.u.s. .p.r.o.g.r.a.m. .a.c.c.e.s.s.i.n.g. .y.o.u.r. .w.e.b.c.a.m.....I.D.S._.T.I.T.L.E._.R.E.D.=.D.e.t.e.c.t.e.d. .a. .T.r.o.j.a.n. .a.c.c.e.s.s.i.n.g. .y.o.u.r. .w.e.b.c.a.m.....I.D.S._.N.O.T.E._.B.L.U.E.=.I.f. .y.o.u. .d.i.d. .n.o.t. .i.n.i.t.i.a.t.e. .t.h.e. .a.c.c.e.s.s. .o.f. .y.o.u.r. .w.e.b.c.a.m.,. .i.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.o. .b.l.o.c.k. .i.t.......I.D.S._.N.O.T.E._.O.R.A.N.G.E.=.D.e.t.e.c.t.e.d. .a.n.d. .i.n.t.e.r.c.e.p.t.e.d. .t.h.e. .s.u.s.p.i.c.i.o.u.s. .p.r.o.g.r.a.m. .a.c.c.e.s.s.i.n.g. .y.o.u.r. .w.e.b.c.a.m.......I.D.S._.N.O.T.E._.R.E.D.=.D.e.t.e.c.t.e.d. .a.n.d. .i.n.t.e.r.c.e.p.t.e.d. .T.r.o.j.a.n.s.,. .v.i.r.u.s.e.s. .a.n.d. .m.a.l.i.c.i.o.u.s. .p.r.o.g.r.a.m.s. .a.c.c.e.s.s.i.n.g. .y.o.u.r. .w.e.b.c.a.m.......I.D.S._.I.N.F.O._.A.L.L.O.C.=.A.l.l.o.w.....I.D.S._.I.N.F.O._.B.L.O.C.K.=.B.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):108544
                                                                                                                                                                                                                          Entropy (8bit):5.334911052722087
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:PORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3e:POBrUC4jyUJGKzgSg+Yco46Fe
                                                                                                                                                                                                                          MD5:7BDAC7623FB140E69D7A572859A06457
                                                                                                                                                                                                                          SHA1:E094B2FE3418D43179A475E948A4712B63DEC75B
                                                                                                                                                                                                                          SHA-256:51475F2FA4CF26DFC0B6B27A42B324A109F95F33156618172544DB97CBF4DDDD
                                                                                                                                                                                                                          SHA-512:FBED994A360ECFF425728B1A465C14FFE056C9B227C2EB33F221E0614984FD21670EDDB3681C20E31234A57BFE26BCF02C6A3B5E335D18610D09B4ED14AA5FB2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........l......................................................z.....@.......................................... ...i...........p..h7...........................................................................................rdata..............................@..@.rsrc....i... ...j..................@..@..............2\........w...........RSDS.).s.rCL..vwZ./B....E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\en\Release\360procmon.dll.pdb......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):53368
                                                                                                                                                                                                                          Entropy (8bit):5.901434301235028
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:O3v+tnPKY4PWWYzpnD9UT1tFGHXjpjqdV9/rfroLoZeNMXN+6Ampc:9KJSpD9+1tFGHXt+PtrgINVni
                                                                                                                                                                                                                          MD5:A891BBA335EBD828FF40942007FEF970
                                                                                                                                                                                                                          SHA1:39350B39B74E3884F5D1A64F1C747936AD053D57
                                                                                                                                                                                                                          SHA-256:129A7BA4915D44A475ED953D62627726B9AA4048FFCC316C47F7F533B68AF58B
                                                                                                                                                                                                                          SHA-512:91D1B04D550EDA698B92D64F222EC59C29B5842115B3C3F1159313B620975BC8475B27151C23F21A78F60ABD6C7FA9CE5CB1EA45F9349942338F9BF0C8CFC99F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...|.U.........." .....Z...Z.......................................................G....@.....................................................(...................................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):6.704024547095587
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7PEyLnAYEFPrQP8tVku+pdhh2eryHU8/7X8r9ZCspE+TM4rSEZsBHUckAwmTcViv:7iYsPVI70HVJeM3Hl7VLQKvrfpMQ3vmc
                                                                                                                                                                                                                          MD5:9D8DB959FF46A655A3CD9CCADA611926
                                                                                                                                                                                                                          SHA1:99324FDC3E26E58E4F89C1C517BF3C3D3EC308E9
                                                                                                                                                                                                                          SHA-256:A71E57CAFB118F29740CD80527B094813798E880DE682ECA33BFE97AAA20B509
                                                                                                                                                                                                                          SHA-512:9A2F2D88968470B49D9D13569263050B463570C3CCE1B9821909E910A8A358E64AD428B86095A18F596D2B3ED77E0E21D40F9C24543E4A0872E6B35C5103BEDE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........................................................0.......t....@.............................................................h7...........................................................................................rsrc...............................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...............................................................................................................................................................................................................................................(...8................................................ ..D...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.11751284678224
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7v4B600ZdPYeBsI7nOSeM3bjhEoz2DDMQ37s:b4B600ZBYwTrv+ozk/s
                                                                                                                                                                                                                          MD5:045E32511A0E333477FFC2361C3B589B
                                                                                                                                                                                                                          SHA1:47EEACAA6381BA81E90A78DCF67C327B9F17814F
                                                                                                                                                                                                                          SHA-256:649CA00BA71A5F725CE94BAAA4996A8C202103B1821A3529E84C20A8D882D35F
                                                                                                                                                                                                                          SHA-512:3693769973D463664D5486A22EC42D8EA722ABD3998AB5C6DEC4A7656411BC90FA3B58A0C01E5117840C2E8025AD2AD9F81BC86B58635EF22CC267BB3781624E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0...........@.......................................... ...................7...........................................................................................rdata..}...........................@..@.rsrc........ ......................@..@...............[........a...........RSDS.7.?be.N.l.[........C:\vmagent_new\bin\joblist\259671\out\Release\en\UDiskScanEngine.dll.pdb............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19512
                                                                                                                                                                                                                          Entropy (8bit):6.980680583875936
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7cRskeR3K+h1MeK6jFj0DGPhC3eFov05MQ3QRv:YuN9K0MeKgFgDGzFoJV
                                                                                                                                                                                                                          MD5:BEEC8C7C207FE28EC4D5465774C57B6B
                                                                                                                                                                                                                          SHA1:06A0EB1B6C8AFEC792FFDA934408BA10EFA4205C
                                                                                                                                                                                                                          SHA-256:1A6782734DCD19ADDB01A716001643E1D26A370D5D2664CF1E2C2646943E1B32
                                                                                                                                                                                                                          SHA-512:EC4F0995711C43D80FE394CD446B11CA21DF4890FE5AE0F68D6A484FB85DDB47982FA8FFFD27171CA1750755069A3B62D7DCDA20814B38A0C005990E9B1A82E4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... .......d....@..............................................................;...........................................................................................rsrc...............................@..@....................................................................8.......P.......x...................................................................................................`... .......................8.......................P.......................h.......................x...............................................................................................................................,...............8...........T...............................................$...................Z.............I.D.D._.D.L.G.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54392
                                                                                                                                                                                                                          Entropy (8bit):6.2287339496325265
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:fCG11xWF7Lp/El6Eh7lKlI019+6JWaeNMXXbBA0bg:KGa7l/8h7I7JWpIXbBA0bg
                                                                                                                                                                                                                          MD5:770107232CB5200DF2CF58CF278AA424
                                                                                                                                                                                                                          SHA1:2340135EEF24D2D1C88F8AC2D9A2C2F5519FCB86
                                                                                                                                                                                                                          SHA-256:110914328D4BF85058EFA99DB13BFEC2C73E3B175B91DFD6B41C6FA72EBAA103
                                                                                                                                                                                                                          SHA-512:0F8B98DED900D9421EB90CFFD527D8218B14354D90B172D592C4945C482191D5E512F2678217C6214ADDB38DA0B9BB9287F84963A50447CF232962BD99B0C3E8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...;.U...........!.....d...T......B...............................................:.....@.....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc...............................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.7828295966719985
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7LyM4ZuyMrj1grjzR+vnr9ZCspE+TMAr3o7hu:7eVzM8z7eM97hu
                                                                                                                                                                                                                          MD5:22A6711F3196AE889C93BD3BA9AD25A9
                                                                                                                                                                                                                          SHA1:90C701D24F9426F551FD3E93988C4A55A1AF92C4
                                                                                                                                                                                                                          SHA-256:61C130D1436EFBA0A4975BC3F1C5F9FDF094A097D8182119193B44150344940E
                                                                                                                                                                                                                          SHA-512:33DB4F9474DF53CE434F6E22F6883DA100473D1B819984171356EEEF523BA534C4ABAF2536596B8758358E755E5D9F3793D85BE12D2D8D5284FC7D13F6C005CD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ............@.............................................H............................................................................................................rsrc...H...........................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .b.r.o.w.s.e.r...M.i.c.r.o.s.o.f.t. .E.d.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.700779948402696
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7VCMqB8x3yMrj1grjzR+vnr9ZCspE+TMAruNNNQkG:7cXyCM8z7eMlVG
                                                                                                                                                                                                                          MD5:5823E8466B97939F4E883A1C6BC7153A
                                                                                                                                                                                                                          SHA1:EB39E7C0134D4E58A3C5B437F493C70EAE5EC284
                                                                                                                                                                                                                          SHA-256:9327E539134100AA8F61947DA7415750F131C4E03BBB7EDB61B0FAB53EA34075
                                                                                                                                                                                                                          SHA-512:E4EA824314151115592B3B2AD8CD423DC2A7183292AA165F74F8E35DA4F142D84D296D34506F503D448C7BD423BE6BF04DA2412B7DAF474FBF4EF6A2AF142BFC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... ......|.....@.............................................................H............................................................................................................rsrc...H...........................@..@....................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .b.r.o.w.s.e.r...M.i.c.r.o.s.o.f.t. .E.d.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):444
                                                                                                                                                                                                                          Entropy (8bit):3.6801510639008024
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Q++uimVb8Fc0g0GPlpUsT4YlgDOQR4lvxXgEOPU70gEOPqaUf0gEOPqgTBf7:Q++ubxeo0GQYn+hR4VxgEbE9LDE9Qf7
                                                                                                                                                                                                                          MD5:2E58B2B687DB6FB6CDDD3BDF2A875FFA
                                                                                                                                                                                                                          SHA1:F4D700DE450BDE53877B824A1021DFD9B52F045A
                                                                                                                                                                                                                          SHA-256:254161D567ED1AE96756809932715790F4BCC5851EBA123BFA6942B2B2D1EB1F
                                                                                                                                                                                                                          SHA-512:258F10FB5F61AD672EDBF2D719E365E1DADD3854F8AE8ABF4005B70324DDCC9CF2C5AA9156BBD9204326D72BDC1B203D2CAF06970B177964FE248C2D90859154
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=.C.l.e.a.n.e.d.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.S.u.s.p.i.c.i.o.u.s. .f.i.l.e.s. .o.f. .U.-.d.i.s.k.....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=.C.l.e.a.n.e.d.:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=.R.e.c.o.v.e.r.....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.U.S.B. .d.r.i.v.e. .h.i.d.d.e.n. .f.o.l.d.e.r.....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=.R.e.c.o.v.e.r.e.d. .a.s.:.\.n.%.s.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8500
                                                                                                                                                                                                                          Entropy (8bit):3.557951484666829
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVl5ENqWIajuwapG4i8nc6WSbJ1J9Wd6AFWbmc:29+DgRgizMG4i8nxWHFWT
                                                                                                                                                                                                                          MD5:47383C910BEFF66E8AEF8A596359E068
                                                                                                                                                                                                                          SHA1:8EE1D273ECA30E3FA84B8A39837E3A396D1B8289
                                                                                                                                                                                                                          SHA-256:B0A2DD51D75609B452A16FB26138FB95545212EB6EFA274F2751EB74CCC5633F
                                                                                                                                                                                                                          SHA-512:3D307569452EC6D80056A3A2E0225D559606DEAB9A6C3913C1FEF7ED6ACA476D7A00190B1BBFA3D032411C2F52427F3096FCE7B7952479AD9B75AA3CEF59D7B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.3362679242046562
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsKVg6PCabR:r5u5/+mMks5qTp1mNqce9Oo16aabR
                                                                                                                                                                                                                          MD5:3997A6ACD6764B3940C593B45BB45120
                                                                                                                                                                                                                          SHA1:16BD731772FEF240EC000C38602C8FCC1B90DFF7
                                                                                                                                                                                                                          SHA-256:A7883C05518F9D1D2AF9773F19F470B25EA94A865FB4D43B9E16518C3434424B
                                                                                                                                                                                                                          SHA-512:FCDC2F450F2771174A71ACB49663F2DE8CD02EB131C1A95DC83ED59D0DCBE676129E960D3FDE5D1CBD9D45FF3F7299028827C8806D867FB51925E41A2C24A2D7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\en\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10568
                                                                                                                                                                                                                          Entropy (8bit):6.811594221456347
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7jp0kvNyMrj6Pu7CrjzR+vnr9ZCspE+TMorCxu:7jpJMMCPHz7eMtu
                                                                                                                                                                                                                          MD5:5EFD82B0E517230C5FCBBB4F02936ED0
                                                                                                                                                                                                                          SHA1:9F3EA7C0778FEDF87A6ED5345E6F45FB1BD173FB
                                                                                                                                                                                                                          SHA-256:09D58A2F0656A777A66288AC4068AA94A2D58D0534328862B8371709EAB2003B
                                                                                                                                                                                                                          SHA-512:12775C718F24DAA20EC8E4F3BDEDE4199C478900B12ADDCB068AE7B20806850FDC903E01C82E6B54E94363725DCFF343AEAC39C3512F5EA58D1BA8D46712AD33
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......S...........!......................................................... .......0....@.............................................d............................................................................................................rsrc...d...........................@..@....................................................................(.......P.......h.......................................................................................................................................................................................(.......................8...H...8...............................................x...............Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.f.o.x.,.I.n.t.e.r.c.e.p.t.e.d. .%.s. .v.i.s.i.t.i.n.g. .%.s. .[.H.a.r.m.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\Antiadwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):137792
                                                                                                                                                                                                                          Entropy (8bit):5.115233634949624
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:gmvblAch7iURov8sapgFnSmrUQ0cL4lwX4Oi3VBPOCJ6+SEz:gJURov8JgFnSVQ0o4qX4Oi3qCUrEz
                                                                                                                                                                                                                          MD5:9CD6C488D13986E2473C21140EE8BDCA
                                                                                                                                                                                                                          SHA1:5BB29A54AA4B849137A700E407A918C0C41F7986
                                                                                                                                                                                                                          SHA-256:8E420FA59C5A42281FC87047BB8195BF9EE0E50E35AF053164F69A083BD263AA
                                                                                                                                                                                                                          SHA-512:9EF21C1058BC672F8D1D5902D4157205FF2B80DD698A4011C809C653899CB627FA82DDC04606556350BE6E36D1D97CBD7AF95754B7B2E71C9250239D68C7F785
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L...`..[...........!.....d...x......B.....................................................@....................................(........?...............7.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc....?.......@..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1724
                                                                                                                                                                                                                          Entropy (8bit):3.5842841064566295
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uLVQQVOPukZfDerF6ujd0DNy3NSY7QDkqDq8e1UYIb:r3LWQVOm4Lkjd0D03NSY7kkq28yU/b
                                                                                                                                                                                                                          MD5:1D204D437EC35BDDED0B741EEEDB1462
                                                                                                                                                                                                                          SHA1:A6DFFCBF1535DEE5529868266DD77B2DB97D8A08
                                                                                                                                                                                                                          SHA-256:3A3267279038B2608E88EDE90623A9D1E058E3B49B580952247009C5F3A94D17
                                                                                                                                                                                                                          SHA-512:49AAC9C4D2F6ECE6A819872DF37A4AB0110B27B1EA06532A2C024AD28A822EC7DD73D895220C643B18EEEDB9694DC158F3F2B7A5EEEDA2ACB8CD63C743A4B21D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.I.n.f.o.r.m.e. .d.e. .E.r.r.o.r.e.s. .3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y.....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=.e.n.c.o.n.t.r... .u.n. .p.r.o.b.l.e.m.a. .s.e.r.i.o.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=.N.o.s. .d.e.s.c.u.l.p.e. .p.o.r. .c.u.a.l.q.u.i.e.r. .i.n.c...m.o.d.o. .c.a.u.s.a.d.o.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=.E.l. .p.r.o.g.r.a.m.a. .q.u.e. .e.s.t... .u.s.a.n.d.o. .p.o.s.e.e. .u.n. .e.r.r.o.r. .y. .p.r.e.c.i.s.a. .s.e.r. .c.e.r.r.a.d.o... .E.s.p.e.r.a.m.o.s. .q.u.e. .e.n.v...e. .e.s.t.a. .i.n.f.o.r.m.a.c.i...n. .a. .n.u.e.s.t.r.o. .s.i.t.i.o. .p.a.r.a. .a.y.u.d.a.r.n.o.s. .a. .m.e.j.o.r.a.r. .n.u.e.s.t.r.a. .c.a.l.i.d.a.d.e... .S.o.l.a.m.e.n.t.e. .s.o.n. .e.n.v.i.a.d.a.s. .i.n.f.o.r.m.a.c.i.o.n.e.s. .c.o.n. .l.a. .m.e.m.o.r.i.a. .y. .e.l.l.a.s. .n.o. .c.o.n.t.i.e.n.e.n. .i.n.f.o.r.m.a.c.i.o.n.e.s. .p.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.591930438694038
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7l6tGRtDGrN+R6I7nOSeMnjgA8nQJ+MQ3TL:Z6toDGrN+LfgAnJML
                                                                                                                                                                                                                          MD5:2B7EFE5248371A6FF34BA8CA2E926D4C
                                                                                                                                                                                                                          SHA1:58CEC28DD2772CBA94E5CE6789618B43CFD46AEC
                                                                                                                                                                                                                          SHA-256:9AD1B2E4F025074324428EE8D021C6A0188DC4CAC2CA64DA43C23B6513342595
                                                                                                                                                                                                                          SHA-512:3F1A5EE5853642165E879425FE72A4950B2A5F502034A4438F9035198CD9884F81CFF1E52E4E4FED3DA8E3129E80CA6BFF702D0DED59849802C4D36547FBF53E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...K;.[...........!.........................................................@............@.......................................... ..x............ ...7...........................................................................................rdata..y...........................@..@.rsrc...x.... ......................@..@............K;.[........]...........RSDS.sl.8fRB.F)ey......C:\vmagent_new\bin\joblist\258920\out\Release\es\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):115768
                                                                                                                                                                                                                          Entropy (8bit):5.359402246395947
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:e2kLlARh7q6RobjausblEJrE4MSye3InFk+yB89weJU:ex6RobsblE+4MSyk+n9u
                                                                                                                                                                                                                          MD5:FD32C93F288339E08BFD3A6FE746FE58
                                                                                                                                                                                                                          SHA1:79C4E984216756CF2E7A6597C8919BAE42620551
                                                                                                                                                                                                                          SHA-256:1ADB1901E78D65623BC536DBF42081D1D501072394605F57E128FE9A8C9609A7
                                                                                                                                                                                                                          SHA-512:5DA9522AB6DB79DC5B22362DB7C9868560211FD50409665322B10C7368BCEB735729128B1AB27DB58092425E6BBC0B24014E69D051C811B6F677BCD3429E2106
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B...............................................$(....@....................................(........................;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...............................@..@.reloc...............x..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):108120
                                                                                                                                                                                                                          Entropy (8bit):5.179960846984439
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:RWPrlAMh74pQFRoIqsw1hJrE4MSye3IECWjVBV0d:RlpQFRoIqsw1he4MSsW
                                                                                                                                                                                                                          MD5:0BE86A32D90C1FE19E9CC89A51C49944
                                                                                                                                                                                                                          SHA1:795C605E04ECE506BF1F3F7404B5761207F3C20F
                                                                                                                                                                                                                          SHA-256:2359205D5F6E7B976464BF5A745B70B7845ACE71373207E3070B01E9A16E81CF
                                                                                                                                                                                                                          SHA-512:81B1A091EE7EBC255BFB028BEC42569B481224BAD90C055DFE35576E63F41F5250032BA97685B083EE88509DE262D6E8715AF79A5A00EAD5FF1E4DB007BAF6C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L.....-V...........!.....d...(......B...............................................<H....@....................................(.......X........................... ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc...X...........................@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):91704
                                                                                                                                                                                                                          Entropy (8bit):5.76032984028652
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:KKmvblAch7UwRoDsblEJrE4MSye3IAdBPoUJG9weh:rDwRoDsblE+4MS90OG9
                                                                                                                                                                                                                          MD5:D370A46B849383374165F98AC5E92590
                                                                                                                                                                                                                          SHA1:3A40B71C8E79FD4E22A87DDEE241C7A6045A0E3D
                                                                                                                                                                                                                          SHA-256:758FE125DD116D7C6FF9DAF3CF2D7C2B81A646FD64FC41A5C7999BD2662CD8DD
                                                                                                                                                                                                                          SHA-512:1E815FB3E603D98ADAAAEFD2FB6B6E8E4285CC24806F528506D996CAD5A8191BF588A36D55F3F9C575E9C7F158244DF10CCD58BD55C930D9E6215A88B64C3FE6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................`......Y.....@....................................(.......x............*...;...P...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc...x...........................@..@.reloc..|....P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\deepscan\dsconz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19028
                                                                                                                                                                                                                          Entropy (8bit):7.989939714131206
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:HAG4SpbwEKYAbje8a66SbGYQoYtIglDTuREcPJCvXr4HNSD:vbSj0SbDQoYZlDT9cPJsr
                                                                                                                                                                                                                          MD5:2154035484A015A2103E7722FD1BF9C8
                                                                                                                                                                                                                          SHA1:19995DC1F4E7FDBB8F2685A11DD1B70B25E9FB0F
                                                                                                                                                                                                                          SHA-256:D3DE1A9F960942F6D71C1658C9BB246580ECBAF287C9591BA27D2705630B4FD4
                                                                                                                                                                                                                          SHA-512:1B42777AB7F2899B9DB172800CF1D4462C744B4BB723F3D237D4C92FC85B5D9DCC5C85C7C5654FA9BF1BAE44FF8CD36598C16DB8FE3AAB2D5FDCF7FDCEC38B02
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<................J.. ...JL..BB..........L................LLLD..HLLLLLLRLEL.... ..{.....5lG..]jo.{[T....._.... ...B.+C.|..D^..H..R`.I[...BM....9.~.x.N31...pK...U.O..''z...w...XA...P...5X..nP..$.DdP<VdF.`d.V...&....h.y.b]7..P}...~..3..3...[c....1..s...[............j.....P.v...i.H.t......d.4.Q.V.KJ%......q....j+.3...b.i..[.....8...Sdy.....L81Dw5.9.%...9...5..!yk..H.IV...6.q.VW..G.3{&)E..{. ..v|K$.....E.gC@a...<t.....cy.4...~..r.$bH.Y...L...F..gN..O....6p..We..N...r{.9..;=.%..O..%]=..J.Y=#...//U.=>...F......G^........p.........c%.a.I#...G...8..8.or......!....o.S..6...L......1.c..CM.m...R.^.[:.@.0..6.j.v..A..#.&..+-..C...E.}./T...>...F......C..A...<^k.{Q,.2xaU...C%%U..m.....<....D....@.~.p......D...=JJ..q.G@...It...TI...?~.._._%5...L......ns.Y..k.....g..............XW7..CzZ9....ce@..M.....d...H9qB..J.%.......t...(.t.....5.i.2h).jK[.B3.\U.hW...aR.....sN.>..B.I:...n...3.U'.3.2.&......%-...dSM.,.Zx0..G7....myc....l...,.=.;d..f..l..|...!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60820
                                                                                                                                                                                                                          Entropy (8bit):5.394097588814822
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:rAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAB:FM4A6UAHRHF4aI+
                                                                                                                                                                                                                          MD5:7503C338BBE0C8CF5938EA07043FB907
                                                                                                                                                                                                                          SHA1:819B2BD7AA27C88DEC748258C9BB7E95FC91B5E6
                                                                                                                                                                                                                          SHA-256:109A21F6FD2B5525C84335ECE2370087BEB189FE908C117841BD43CB707CBADD
                                                                                                                                                                                                                          SHA-512:715439C41A2B187B9DB05F31D3E6FDF06BBB65CC5FC32A0ED1623EE80B7786AB65010C4227112FCA275D91D6B4239BA1A7245DD8A9CC496B80DAC16697270DAB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............X...7mA}................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25664
                                                                                                                                                                                                                          Entropy (8bit):6.290409760927645
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7XLhwAKz94p6UCy+5td9I76eR3KJ1Mr8yqDGPhCakov05MQ3m:jLhwAg9G6UF+5t8b9KvMrQDGvkoD
                                                                                                                                                                                                                          MD5:B304C9966AF72CD7C07CBFBB2232BAF2
                                                                                                                                                                                                                          SHA1:4F883F6D98678888AAC9C7D6FAFFA7B9869FA8F7
                                                                                                                                                                                                                          SHA-256:D7C3E3535865383DCDDC2C7834BCE521B7891E7C167081326127DBC2D0A0816A
                                                                                                                                                                                                                          SHA-512:C36C812AF6F7A3BED42DB17B68CCCCEA2B0D0C78604885EA905B3CFA0E9588E95DDA9B3F03F623F7C3B6542FDD8E26E8B30D3838D294B1240A5A7A6933FC8FD6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........(...............................................P............@.......................................... ...%...........,...7...........................................................................................rdata..y...........................@..@.rsrc....%... ...&..................@..@............. ._........]...........RSDS..Q..a.A...tr.......C:\vmagent_new\bin\joblist\503376\out\Release\es\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49784
                                                                                                                                                                                                                          Entropy (8bit):6.37404600550252
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:+y2lF/WFLLpAEl6Zh7laV5tf01NtY+6JWztWdvnB5dTb:X2kLlARh7HiJWJWdvnB5dv
                                                                                                                                                                                                                          MD5:8075E40B548F6CA6BAAC9F0E927D8EF6
                                                                                                                                                                                                                          SHA1:1C40281482D10BF0791D8460B95573562F9658C7
                                                                                                                                                                                                                          SHA-256:E2E9896B2D083BCE5528839D646622A6A7542E3F7D5882FB3333515E2D0572E7
                                                                                                                                                                                                                          SHA-512:73AB58A71D191740A1CDF306AC9484C70B0A4C1A051F9DF1A8EDF0B5138759513CC5AFA297CD24D26909915BF591F9D95AC7A4C37ADAEC87E6C5B96A967592B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...].U...........!.....d...B......B...............................................Ao....@....................................(.......H........................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...H...........................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48248
                                                                                                                                                                                                                          Entropy (8bit):6.068172727091871
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:tXHGdBPASgYoH6dzSnq5TmtzG3TpMtaNVNs8lAKYertA5/l5R:sASgRcSqNmtzG39MkflASrtQ/lP
                                                                                                                                                                                                                          MD5:39D2BCAD99E1825F3BB1AF4C84BDFF50
                                                                                                                                                                                                                          SHA1:38718C6F7F93D52710864A0EC7B5EE17F6BC6DC0
                                                                                                                                                                                                                          SHA-256:FF86F7D58B0CA1ACFBA64A3AF59824D7A38BC2C8DF495D10ABA4A0A419584A23
                                                                                                                                                                                                                          SHA-512:1E12C4A3277FF374AC697313ED8DCF6C062C91B185ADF2B6E6A458E8F5832660BB0937BE6B6EC0599AB7D39C4734E81F642E40B6936D6A26B35FE8A86A64F620
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...N.U.........." .....Z...F......................................................j.....@.................................................h...(.......P...........................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...P...........................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21472
                                                                                                                                                                                                                          Entropy (8bit):6.313150885146629
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7bFSMw9WmTeBr9Q18ILz46ki2cP0iwfLp5NS+ShjmM6IGBkS5H:K18ILP2cPfwtS+ST6nkiH
                                                                                                                                                                                                                          MD5:3197FD618788041EF7A6C15FC0566990
                                                                                                                                                                                                                          SHA1:89AC8DC36392019C1419D06043E72288245DA82F
                                                                                                                                                                                                                          SHA-256:9F60D1461C7A111347E6B135D5116EEABF272C6EF6979FABFD2F27316ACF6462
                                                                                                                                                                                                                          SHA-512:42A734734D943C77377F80A483BACA6D5262FAD4C32D246E53F42B168DEA7A04F8724AC46BB739AAEC4ADC8EE3BA1EE3FA9FD04AC50C0FF27EFDA19A941CCE11
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........&...............................................P.......]....@.......................................... ..."...........*..H)...........................................................................................rdata..r...........................@..@.rsrc...."... ...$..................@..@.............#pf........V...........RSDSR..HG..F.R8.(&,_....C:\vmagent_new\bin\joblist\815456\out\Release\es\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19936
                                                                                                                                                                                                                          Entropy (8bit):6.476713186014521
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7K7BxEqz+9ll0jP++6ki2cP0iwfLUmhQS+ShjmM6IGBkSpeq:BGjP62cPfwjQS+ST6nky5
                                                                                                                                                                                                                          MD5:D7D2D7317A6F6BE7488E9A3071F6FD09
                                                                                                                                                                                                                          SHA1:FDE3E2790DF3DD4E1766CCE11289A847BB8B7756
                                                                                                                                                                                                                          SHA-256:3E9F316BD46727C981A3D00C8EDE438CD8C778D761C55E6B6DB8C8C2BE52B098
                                                                                                                                                                                                                          SHA-512:526BAD9B569C46E32083EE0C9072970B93BA8A9F9D7E7FB435E72508A6A32E9A33E2B8D57311232BD7D42BC067C76CFEA2DC31662CFAFCAE561D94F0E0C3976D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!......... ...............................................@.......n....@.......................................... ...............$..H)...........................................................................................rdata..u...........................@..@.rsrc........ ......................@..@.............#pf........Y...........RSDS.....A..g.v..B....C:\vmagent_new\bin\joblist\815457\out\Release\es\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.968514351588424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:5vHP8qNfXOKM5VHblx1qhvmVqC7exscB3neUvESwTPprqWPQTUDnwENL1c:hHP8KX5M5VHRivmsCescReUsZPqid8
                                                                                                                                                                                                                          MD5:BD29091BA65B3FC08C79654997B4C82B
                                                                                                                                                                                                                          SHA1:3B353EC41DCC96D898715F6474656F13931C1B61
                                                                                                                                                                                                                          SHA-256:A3CFC3C8F95F0ED56306D28AC87408F10875C43BCA7778C6E1CC18C7A3441183
                                                                                                                                                                                                                          SHA-512:AE64DAE0E4025968BFB14E57C2FAAB0C9DA39943DAE9C884CBBD940433B29613C090B98899DB847C94B265F969A6ED3CFEBFF35AF284CA9619E6E25937067650
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................A..a,.@.-_...#.....2..vI...^..2..H"..........yU.;.i[..{.~:p.u.!...&..JnZ.......)px...@-T......7.HK.)...Z...[@n,4..h.C.!....#..w%..w.`...0..$................0...............q.%H...CK.d.d.=\I...).../..UQ.9z..@.(..gc3v.... ..v..+......`f.~.z........o+..}..az............(-z......3.*..7>T8O...._='..P.hX.....Itvz...r~$.....r.3....L.e..H|. z>x!;C..J..a.=..c$.....6..6..._s~..b"-...!.fI.&....w.]b......+....b...U./..m.6[.o.DS...=>..._C8.Av..yy.^*Sh-.s..Z......w\.n.;...q..h..Q.....<..V.........t.....4.6..F..=Q*..........0B..h.ja..=......|..>dz.,.)......&.......3..|..;]"q..A......R.y{.......$.d.L.:.......]j...G./<mFJ.!.,Lc.....Fcvw..{4.SH.*..m..l..|.?`N=d.l....O..y~....u9..?s....Jy..P

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32908
                                                                                                                                                                                                                          Entropy (8bit):7.98579519717503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:mqPy0zBxmlBLCxBIZuPVOWdT0bQUu9d2+8Pc1fCrGrP:m90nmlBLSBjt/T0MUu2ofCrY
                                                                                                                                                                                                                          MD5:F507C8DB8F8EC9361F36608408C9939E
                                                                                                                                                                                                                          SHA1:F3915EDB67FC281DDE5657B383E3A5AEDFE96BB8
                                                                                                                                                                                                                          SHA-256:DAB50E3C2787808BEEB0B377AD7C3DE2C518578B9F7A4EC4AC29063D59C00B3D
                                                                                                                                                                                                                          SHA-512:CB09E4F033B873211BFA8B8B82FA207EA5C176D8D686487C2253214F5F965734D2A16A04AE41B849FFA20B3B03814714274B749F07DBC28A0A5676A86630FEEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................r.e.g.m.o.n...d.a.t..............................................................................................................`1.!.../.C~.}.Q.i.{,..L......B.PG...xJ..L#.......B#.5J?.j}..f..`x.F.dG.p......."...VOn%.%M.D.;.F;.XL].o.S.DK....F[.....]....#..w%..w.`...0..d.6..............0..........X.6./).5.b..V..p,...u}".~..t...0...r..6,...c.....y..>.....lxh.t...O...-}~.c..1.'zv:..s..t^.|....%.."k.c....n.....J..x&. ._.-...\.9>.$.q.).~........v...b..IY.{...cp.f5..F.&..o.].V....0..J....w..f].%...!..\t.s+.J}....7.X..nI.z.M0...5...)x.8\G.._..w@.'..1....?=D.y.:Hw...9.@.Y.9.hd...$h^..I.G..gy..j.......5...nB.4 0!e..N...WQ.k....:x.9.`........3....38...W[..K1..{Q`..5P&z..8.J<.`.'+.i.y..0.a"Zu......KS......M..h...O..qbj..$../Z.M&...;...`..n.>..#.8. .m...|...s.$.K.T*c.....H.Z.S...P..5..#....^[.a=...........V.k..)r..%.i_.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):6.765676623398517
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7gq5HORq5mlpjrc1Aj56ki2cP0iwfLlL6yS+ShjmM6IGBkSk:P2c1+c2cPfw0yS+ST6nkT
                                                                                                                                                                                                                          MD5:CF72FE7ED46F51558D3FF6B956949111
                                                                                                                                                                                                                          SHA1:BF3F3B8B67C638C70CE5AA72B5EAB5F6D171BC31
                                                                                                                                                                                                                          SHA-256:769A4871E1253C584CC2665C7D961B17B7F97B97B040DF3F72B9D1F5489B2EA8
                                                                                                                                                                                                                          SHA-512:A53301FBE011FE97130A6594BDEB236ABFB66208627AC9E0F545E5142602D25724F9AFC4C44545A0FC6A14C78A31BAF5E4A22EF57C67F56531899BE0FD1811A3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...cfrf...........!.........................................................@......9j....@.......................................... ..................H)...........................................................................................rdata..t...........................@..@.rsrc........ ......................@..@............cfrf........X...........RSDS.. X..AF..\..<.....C:\vmagent_new\bin\joblist\815994\out\Release\es\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1060, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1085440
                                                                                                                                                                                                                          Entropy (8bit):6.835054465813552
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:MMM9kj60n0SKYbN23D/X1WgtjrY8Y0iWB8B3pGpTbhYG:gQ6rSVN2371WgtjkX0XJ
                                                                                                                                                                                                                          MD5:3D574DDE7D99AB751032A1C0C2F65D33
                                                                                                                                                                                                                          SHA1:15727C845DD91D2F9EA57943A8EDB2E75CFACD6A
                                                                                                                                                                                                                          SHA-256:86AF283B76825C38AAC536ED602E6E0A71F524D0CB110963B300B9082851C5F3
                                                                                                                                                                                                                          SHA-512:A6FA864975B81470F8BF153603F73EA16FFCE00D9707C6AD6C3CE57788624D728EDE3B238D184F63DBD6CDC35976CE36B6B5A0DCA242840EB66B1F9F708F83B1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......$.................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\libsdi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:OpenPGP Secret Key
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):104660
                                                                                                                                                                                                                          Entropy (8bit):7.998370923720517
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1536:MPr8TPtonhgqroa39A3WCzRBv9FnutBHwHcK7GRY82E+2/K1gV5OvlU8VEoB:VPtoNrr9efDGtBHGT2/6ALkdB
                                                                                                                                                                                                                          MD5:9DFA9756E5F7148DE404B29BE3940669
                                                                                                                                                                                                                          SHA1:4BD38B2BD4F5D6367F44A1BBD6F29DDBCBED5510
                                                                                                                                                                                                                          SHA-256:57EA3B32D293FF6649266C0F5427DBCA3782079F96AAF002B9730D8A9D6C4D2B
                                                                                                                                                                                                                          SHA-512:09A91814E7F521F83C4E8191B5BCE4EC849172E3B6BF6F3925E6E5F6109F3F3014F52741A2237069E372C42AD65A66B58466E7AC721B9E3CC56BE1588A0A9D7D
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.0...a.C.[Q\.%\B.........^..2.8:..1'&....dv.(...i.......d....A.-.m.`>.......g....,..M.4i..l..$.3.?.dO....1..'I[.9*..i..-.V[.4.F1..E.W.%.R...6.p9y...t.=!...&bs....Z..x.u.vY............K.v.k....y...>......u...u..}.(.nui..K..0tY....cCZ."..n.m...=V...J........X.%.I0....y.>%:.^..n.?{uB.w..-..(~....8.A35..3..j../k....m....-m.%..s...)X.9tb.=rcf...{..+e|..6.....[!.d......2C.91I.....O...V.&.!((.'........W..B{...U..^.2.v `..O"..w....C..z.Wx..x(p..d.}.,.3..3..d..BBn;........\@VF.]K.....)..|..*..:..B..u......3.0n...8..).I.&.i...~v..`.....t.2f..P~..z.9}.._T../...8-.X..>.................d....>.\.f.2......(..g.WV|8;p...\.v...[.....?.U.k..x.?.`@V^.h..q#b.~.$.d.(^.........0$.:.K...,~.... J._....Ah.@.Rw...F...@mZ.G..........gQa..I.nG}$....7.b.,.....h....H.Q.....8.t-k.....O...g=..7e....o...rV........Y....xn!.&.......MA..o..ydM.l......X.f.l....A...>4...9I=....e..*.03.{1.`.....h...Dv.,.5.q1x_.c....w..8..$.....G.9.....=........4.;.B..T.k.ukv........Y.$..`

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007009, page size 1024, file counter 221, database pages 791, cookie 0x8, schema 1, UTF-8, version-valid-for 221
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):809984
                                                                                                                                                                                                                          Entropy (8bit):5.829943224004249
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:f/nCExkRpiJhfKNJhhNdTTOfPd/m9muisx3U+ck5l:nCExkRgJhfKNJLvMPJm9muT3UQ
                                                                                                                                                                                                                          MD5:48F0A2F728AA55A1C5F569EC8526EF5B
                                                                                                                                                                                                                          SHA1:02A538120791FC0CD541C9A4736D734F57FA4657
                                                                                                                                                                                                                          SHA-256:B3D41A80DF1BE1E1CFF9EA07AB1ECBE818A426EE6C06ADFE63CA12ADB2374DA7
                                                                                                                                                                                                                          SHA-512:1F23A901927299E2061EE693BDC3F5499BF0EBF83EB387131E2F94F72881A9AF7A3AA8C48E24823717817B172EF597E9A568CB3B65D8B52D3E1DA40279331F0B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.!.......................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):39344
                                                                                                                                                                                                                          Entropy (8bit):6.39004974859246
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7SacsultAgwBAP3ExcizfbFpO3Nj1beQVnYPLdOSeMEm/eDh4jl+AHKnTu:Ot4B23ESYfRnQVg/Xlk6
                                                                                                                                                                                                                          MD5:EAD1123DB0E873E270795D8CD5A2A208
                                                                                                                                                                                                                          SHA1:F013DDE5E2676D770A33B7AEB823D97BE6956EC8
                                                                                                                                                                                                                          SHA-256:4472BAFF3BB3D2520C3D97DC7AFD337D3D57F6FF6A85E06FD335037E5D26289A
                                                                                                                                                                                                                          SHA-512:84FF1E0A1E0F4CD244BB0DD7F3A88A6F256E1B889C33D14F27B7D32F0554E4DD0B4191DC259804752663FD9422142CBDE4F62D310787C4604845BA09968888E3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....W...........!.........`......................................................,.....@.......................................... ..L\...........d...5...........................................................................................rdata..{...........................@..@.rsrc...L\... ...^..................@..@..............W........_...........RSDS.3.p.!D...........D:\codebase\6.2_uinstall\i18n\I18N\SPTOOL\ES\Release\360SPTool.exe.pdb..............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1854
                                                                                                                                                                                                                          Entropy (8bit):3.628223432252504
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uNYDHADvDUDTw1lTxD0nuHD+nu7JUqDbt+jM8iIDf:r3Nc0vDgTw/T17jZ7mObti/iMf
                                                                                                                                                                                                                          MD5:7AB29B181E398328771F0BAAB539804A
                                                                                                                                                                                                                          SHA1:93C32F7918D27AA5E89376F7EBA2521D343D59C5
                                                                                                                                                                                                                          SHA-256:3130A56D7BC5EA3AA873DBF65700079F8B32972935CD49687B1CE530C0B1B849
                                                                                                                                                                                                                          SHA-512:888DB65CC653BEF47B251F6D529741DF2F34F1E59E4D86415323A6EEA88795B8BB3F2833C53C80FDF0B1528D0B7DB139AF3F978B28C81D798AC71379655C8FBE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=.U.n. .p.r.o.g.r.a.m.a. .e.s.t... .a.c.c.e.d.i.e.n.d.o. .a. .s.u. .w.e.b.c.a.m. .....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=.P.r.o.g.r.a.m.a. .s.o.s.p.e.c.h.o.s.o. .a.c.c.e.d.i.e.n.d.o. .a.l. .w.e.b.c.a.m. .....I.D.S._.T.I.T.L.E._.R.E.D.=.P.r.o.g.r.a.m.a. .m.a.l.i.c.i.o.s.o. .e.s.t... .a.c.c.e.d.i.e.n.d.o. .s.u. .w.e.b.c.a.m. .....I.D.S._.N.O.T.E._.B.L.U.E.=.S.i. .u.s.t.e.d. .n.o. .a.c.c.e.d.i... .a. .s.u. .w.e.b.c.a.m.,. .s.e. .r.e.c.o.m.i.e.n.d.a. .b.l.o.q.u.e.a.r.......I.D.S._.N.O.T.E._.O.R.A.N.G.E.=.E.l. .p.r.o.g.r.a.m.a. .s.o.s.p.e.c.h.o.s.o. .q.u.e. .a.c.c.e.d.i... .a. .s.u. .w.e.b.c.a.m. .f.u.e. .b.l.o.q.u.e.a.d.o.......I.D.S._.N.O.T.E._.R.E.D.=.E.l. .p.r.o.g.r.a.m.a. .m.a.l.i.c.i.o.s.o. .q.u.e. .a.c.c.e.d.i... .a. .s.u. .w.e.b.c.a.m. .f.u.e. .b.l.o.q.u.e.a.d.o... .....I.D.S._.I.N.F.O._.A.L.L.O.C.=.P.e.r.m.i.t.i.r.....I.D.S._.I.N.F.O._.B.L.O.C.K.=.B.l.o.q.u.e.a.r.....I.D.S._.I.N.F.O._.R.E.M.I.N.D.=.N.o. .r.e.c.o.r.d.a.r. .n.u.e.v.a.m.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):109056
                                                                                                                                                                                                                          Entropy (8bit):5.349707022984476
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:HORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3R:HOBrUC4jyUJGKzgSg+hBa2QOF4
                                                                                                                                                                                                                          MD5:437B746E0F469C41D075DACD54E4AD4F
                                                                                                                                                                                                                          SHA1:DD0CD555B54D47675F75FE438E8983684681B6D7
                                                                                                                                                                                                                          SHA-256:C9E1188911939E93153AE9E14485DBF9910F20B3682DB8EC9B08912098F3BA46
                                                                                                                                                                                                                          SHA-512:76517114BCACE78A1D1A69E89122010F7D9506DD4CDE0AF3424DC60BD45DF6544978DCA75A746C6AC4C22B8D0E8E2FF62FF1A14389AA29E10EE3C7732AE03516
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........n......................................................@v....@.......................................... ..hj...........r..h7...........................................................................................rdata..............................@..@.rsrc...hj... ...l..................@..@..............2\........w...........RSDSq..K...O..X..o......E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\es\Release\360procmon.dll.pdb......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\Safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54392
                                                                                                                                                                                                                          Entropy (8bit):6.201931870040246
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:dCG11xWF7Lp/El6Eh7lKlM01y+6JWnPZ5BAA3:0Ga7l/8h7osJWPZ5BAA3
                                                                                                                                                                                                                          MD5:B2075BEE61BF4AD7EAB80EC0977A8802
                                                                                                                                                                                                                          SHA1:A1EBC578277F1100E066E339641409C70D0E4BA6
                                                                                                                                                                                                                          SHA-256:D7F10DEF753EF6B7332FE20A61B84B7D73033996F4E516CBE3D8AED08B32DE3E
                                                                                                                                                                                                                          SHA-512:20091393F590F1869EBFBB06F2946846ADC134329D0C35CDC8E19CFB366ADF824F8768F00D71002E20F9DAA8E2003FE6D4EE186D4CD3D51BF49F6F97D5FE086F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...y..U...........!.....d...T......B...............................................#S....@.....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc...............................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):53368
                                                                                                                                                                                                                          Entropy (8bit):5.893548643255975
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:X3v+tnPKY4PWWYzpnD9UT1tFGHXjpjqmVH/rfroLoQPZo6uuSk:wKJSpD9+1tFGHXt+UbreZruuSk
                                                                                                                                                                                                                          MD5:DB9AF39E5001611C506CD637A189EFD6
                                                                                                                                                                                                                          SHA1:C9D49DE915788A5DAD939CE749FCC20B65D072D8
                                                                                                                                                                                                                          SHA-256:FDD2ECC99C326D014F0E63E7DC9E6A4C8F2B570DD636ACEE592A9C2160DDF3DE
                                                                                                                                                                                                                          SHA-512:77159B8810D57002F79ECF30A8002978A8869BAFF291D9A5B5394E9D0CADDB5DFEA34C76D9C91A0642BC5853EBE669C47A669295BBD78A7D76D48A50009C8DF8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...K..U.........." .....Z...Z......................................................;S....@.....................................................(...................................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21504
                                                                                                                                                                                                                          Entropy (8bit):6.7519090680650695
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7pnUh6YQQjcI70HVJeMVLEHlOZ0QKvrfpMQ3vdQZL:dnUhnQKDQ17EFs0QwJO
                                                                                                                                                                                                                          MD5:84471CF670238C39266ED90DB5053B92
                                                                                                                                                                                                                          SHA1:3FB31E1D7F1AC0B66D34728BCE267A2FFEA94E76
                                                                                                                                                                                                                          SHA-256:6FF5338956EC58F8D53E289EA7EF8CC190A766E5C6CE75C0A38F0110FB659EDD
                                                                                                                                                                                                                          SHA-512:CF49EEB5E2221289E65057104D80A54C760D1947FE5D14A9A92332FCDCACC98574D0AEEA2793049A2143187C0C7BA7EA24F072D84E2F41D12334BA75628FE3B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........................................................0............@.............................................................h7...........................................................................................rsrc...............................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...............................................................................................................................................................................................................................................(...8...................h...........D...................D...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.108524929949801
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7zB60nZteI7nOSeMoWIja+tA8nQJ+MQ3jl+Z:HB60nZtdbGayAnJYm
                                                                                                                                                                                                                          MD5:4AD68EF515F495E2E4B7535E68A56C0D
                                                                                                                                                                                                                          SHA1:DE104A699B3D657FA4271009161B7671527C1324
                                                                                                                                                                                                                          SHA-256:CE0515DDA14B94865E505785E2B0CB51E24248D2EABE71593DCBAA0915DDDDC4
                                                                                                                                                                                                                          SHA-512:890CF5CEF0F5CA0C46D8577D261731A490D36B0C9BA67912DACD05BC4FE2C81BD8457F87534A9867DB25E854ED3EC1BC63281EDD80AE6561556914205FD4396B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0............@.......................................... ...................7...........................................................................................rdata..}...........................@..@.rsrc........ ......................@..@...............[........a...........RSDS..3S.Z@O....L.)M....C:\vmagent_new\bin\joblist\259671\out\Release\es\UDiskScanEngine.dll.pdb............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19000
                                                                                                                                                                                                                          Entropy (8bit):6.974235455234146
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7P+tAMoefDqleR3K+h1MeK6jO06DGPhC+6ov05MQ3E:L+tAMoKDqI9K0MeKgf6DGD6o
                                                                                                                                                                                                                          MD5:C3AB60DC2295563A1539B4D24DA1AAFB
                                                                                                                                                                                                                          SHA1:80E34F7C5A5A5A7ED6ED232AF025379C528FD329
                                                                                                                                                                                                                          SHA-256:5D9ABF5AEA21B9F049967775868A9CB4067EC0F5BB7742EB196305CCBBC70033
                                                                                                                                                                                                                          SHA-512:AC3FF4164D2413323EB11BDC2B242A1C18134301D2EE54081AE68C837432406D1F81227086A08C64F21B3BECF6921F38F8D288D7F92661C15D3F6A10444FAE07
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... .......n....@..............................................................;...........................................................................................rsrc...............................@..@....................................................................0.......X.......p...................................................................`...........................................................................0.......................@.......................P.......................`.......................p...............................8...........................................l...................................Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................C.h.r.o.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.780487035386465
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7MmTMvZKsVyMrj1grjzR+vnr9ZCspE+TMArMnJhEx:7NSZdsM8z7eM5J6x
                                                                                                                                                                                                                          MD5:D71CF00D2FD825391F0E522C18CD63FC
                                                                                                                                                                                                                          SHA1:F8AF62F0CFE37729F62AE89E7B37E3BB9FDB7E3C
                                                                                                                                                                                                                          SHA-256:F5D2C33476DEFE44CF4D47CC7B1141A86A6634D31F30634081A119F7FB829B82
                                                                                                                                                                                                                          SHA-512:A22BEF6F81299C34D1C145608C0D1AF4267710FCE1BFEEB7A1A7570B19E7FDA0710B6A504F518E2778359A7309C116A9B45E6B7ED7D17614CA2891C40E9E76C9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... .......[....@.............................................P............................................................................................................rsrc...P...........................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...N.a.v.e.g.a.d.o.r. .S.p.a.r.t.a.n...N.a.v.e.g.a.d.o.r. .

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.69750229705802
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7Dm4Mt1s/7yMrj1grjzR+vnr9ZCspE+TMAri9cR9:77g1smM8z7eMXcf
                                                                                                                                                                                                                          MD5:8FAE06356C5AEAA6876B407615127064
                                                                                                                                                                                                                          SHA1:AF123A72C6C04AB7C79987EBA1D2768AA1B7AC9E
                                                                                                                                                                                                                          SHA-256:0B8E7C0E848FB6041107D2C83225C4B37CDEC37D61D349883FA0B02D6DBFB7CE
                                                                                                                                                                                                                          SHA-512:09F7EC50090EBAF2BAA703D3D6347FDAC7A218831282F4C36AE11A6938A4298D35BADFD47D8A82C6C656B4FC3D10FA90F8412F369189391492B4B6D1F28FC932
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... ......j>....@.............................................................P............................................................................................................rsrc...P...........................@..@....................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...N.a.v.e.g.a.d.o.r. .S.p.a.r.t.a.n...N.a.v.e.g.a.d.o.r. .

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):482
                                                                                                                                                                                                                          Entropy (8bit):3.686395261540533
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Q++ubxayD0GQWtqkXmhR4EgE5KE9dI0leE966N3:Q++ug0ztq+6FL20l/66N3
                                                                                                                                                                                                                          MD5:6F068BFADF0A6D759BBE9610BFA85A50
                                                                                                                                                                                                                          SHA1:7B08C50881130F7CD6369D9714E9D4D2C5FBA127
                                                                                                                                                                                                                          SHA-256:C4589266ED0867C2432429F44615A96795AF9CE2EC01D1857542D91428420C19
                                                                                                                                                                                                                          SHA-512:98A32FD0EEEB76AA8D9BD806911EAAB430D4175ECE62692945B67FFF3680686B3980240A72E95AECF776A5FD3D1CE708A078E9878A26649F04062450E4E8D230
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=.L.i.m.p.i.o.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.A.r.c.h.i.v.o.s. .s.o.s.p.e.c.h.o.s.o.s. .d.e.l. .d.i.s.c.o. .U.....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=.L.i.m.p.i.a.d.o.:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=.R.e.c.u.p.e.r.a.r.....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.C.a.r.p.e.t.a. .o.c.u.l.t.a. .d.e. .l.a. .u.n.i.d.a.d. .U.S.B.....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=.R.e.c.u.p.e.r.a.d.o. .c.o.m.o.:.\.n.%.s.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8534
                                                                                                                                                                                                                          Entropy (8bit):3.559746642617768
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVlujNqWIajWwapG4Bj8n5t6WSbJ1J9Wa5sFWbmc:29+DgRgiz0G4Bj8n5uWfFWT
                                                                                                                                                                                                                          MD5:638B94A4675B4572E145C193CD222F89
                                                                                                                                                                                                                          SHA1:1016A257AF80F5E123F59D54F4459ADDB08D8B4D
                                                                                                                                                                                                                          SHA-256:BB600E5ECD40B5B3FCBEEF92910837391CA11C34BCE4019A74B8997C7111A349
                                                                                                                                                                                                                          SHA-512:F663031948D9CBBF6C8B98C052B1C830B4F3B5C108DDA5BD01FC37FBA196620477DB4D442DE15F1517FE6512B4068FF6B8FAA1AFA80EBFE09A6DEF03ECF49F5E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.33632788666422
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLs1g6PCabR:r5u5/+mMks5qTp1mNqce9Ooe6aabR
                                                                                                                                                                                                                          MD5:FEEBF9F9E48147D1B623C67DA7AF2FBC
                                                                                                                                                                                                                          SHA1:16AF1188B9560034FC072BB2FE11EA08408FA4EF
                                                                                                                                                                                                                          SHA-256:9F6F6A3D8271AA360F18A55D4D093D13D38972697AEB4F4A090D96EB3DA418D6
                                                                                                                                                                                                                          SHA-512:3D5A8291E122DE089B6A7C9E6D882DB1EDB616C665360FE6425A15CCBB4AE3DC3DED938A888B1AB75C1565DE624CBA5E10D1973B3E7DBCA641EBB6DB37CA4EBA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\es\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10568
                                                                                                                                                                                                                          Entropy (8bit):6.770350684619658
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7g0YYdxyMrj6Pu7CrjzR+vnr9ZCspE+TMor63dXMh:7gUdQMCPHz7eMRtXi
                                                                                                                                                                                                                          MD5:86480218B103A3471E0322ADBF15F50D
                                                                                                                                                                                                                          SHA1:5D752666DA8626C27A1EDC01617560AAC9D59FD1
                                                                                                                                                                                                                          SHA-256:C9F3F2363ADA2CA3957C227B5EF26DCB172457D0803F5AD8BC8B724B0749AF9E
                                                                                                                                                                                                                          SHA-512:E5DBE00FE82BBEA81E9A192EFFD766EF8B60A0D9583F7CF5035C1E39AB5277A9DE7321C3F70ACCE4763ABEA797060A03575C25E472D475CEA890F86472D23573
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....~.T...........!......................................................... .......x....@..........................................................................................................................................................rsrc...............................@..@....................................................................0.......X.......p...................................................................`...........................................................................0.......................@.......................P.......................`.......................p...............................8...........................................L...................x...........D...Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):152640
                                                                                                                                                                                                                          Entropy (8bit):5.001332721780709
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:emvblAch7ygRom//cjG4AqAmrMBgvJEBPOSelw:eZgRoDjG4pAmYMJnSelw
                                                                                                                                                                                                                          MD5:5FDE8AC2839824B80A68A7D4FBB39188
                                                                                                                                                                                                                          SHA1:153ABA9BE28B48FEB5D1544DFB63E6AC422587C0
                                                                                                                                                                                                                          SHA-256:607064603A0F3336959A2ED9EF1029AB9CA4BE33E76F6B80ADA8540ACBE6D9E2
                                                                                                                                                                                                                          SHA-512:49F6DE3CC9AFA11EE199841D202301325DF3D28F136D6B349A5392CF517C7ABDC804820ACD3E951211BBE717A6F8586FAB1D370195655F656208B0F08DD81B2D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L...p..[...........!.....d..........B........................................P............@....................................(.......0x...............7...@...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc...0x.......z..................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1768
                                                                                                                                                                                                                          Entropy (8bit):3.595844321850806
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uLuqQVDxiS6MmermMgWuKNycgCaabDfDaOXDwY7Irqh4ekg/:r3LuqQVDxPNKMu4yWa+bDfwY7qqh4U/
                                                                                                                                                                                                                          MD5:AC425C345ADAF8414BBCB1199F9DF6F3
                                                                                                                                                                                                                          SHA1:C42CB326A643F4875F9EAEF93385C8A38FA4EF4F
                                                                                                                                                                                                                          SHA-256:50896D4A4764D960AEB45BCF8BF7832D4B33F94F119C0E91439C49B9D3DA11AF
                                                                                                                                                                                                                          SHA-512:57A04CA9D361875FF119EE20BE0FB05FC878844FB5D1565484384437C6D68D3156F914F0FCD5BF3B90C46D9C5B73F7E6E0B611ACCD2A8DF20F2DD2594A3A12EC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.R.a.p.p.o.r.t. .d.'.e.r.r.e.u.r. .3.6.0...T.o.t.a.l...S.e.c.u.r.i.t.y.....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=.a. .r.e.n.c.o.n.t.r... .u.n. .p.r.o.b.l...m.e.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=.V.e.u.i.l.l.e.z. .n.o.u.s. .e.x.c.u.s.e.r. .p.o.u.r. .l.a. .g...n.e. .o.c.c.a.s.i.o.n.n...e.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=.L.e. .p.r.o.g.r.a.m.m.e. .q.u.e. .v.o.u.s. .u.t.i.l.i.s.e.z. .c.o.m.p.o.r.t.e. .u.n.e. .e.r.r.e.u.r. .e.t. .d.o.i.t. ...t.r.e. .f.e.r.m..... .C.e.s. .i.n.f.o.r.m.a.t.i.o.n.s. .n.o.u.s. .s.o.n.t. .u.t.i.l.e.s. .p.o.u.r. .n.o.u.s. .a.i.d.e.r. ... .a.m...l.i.o.r.e.r. .l.a. .q.u.a.l.i.t... .d.e. .n.o.t.r.e. .s.i.t.e. .W.e.b... .E.l.l.e.s. .c.o.n.c.e.r.n.e.n.t. .u.n.i.q.u.e.m.e.n.t. .l.e.s. .d.o.n.n...e.s. .e.n. .m...m.o.i.r.e. .e.t. .n.e. .c.o.n.t.i.e.n.n.e.n.t. .p.a.s. .d.'.i.n.f.o.r.m.a.t.i.o.n.s. .p.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\LibSDI.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):116804
                                                                                                                                                                                                                          Entropy (8bit):7.998457445151517
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:kAGVpuqnFPPLtiKsfYeCnQ9qPznWj/NEWI3Hw4nAyK:k7uqn9DFeCPzWjKWeAyK
                                                                                                                                                                                                                          MD5:FD950EE136EC0677DD50E62E09F323F1
                                                                                                                                                                                                                          SHA1:38E77D1DE6488BCC1FB3E6E8651CF42C8F9F86C6
                                                                                                                                                                                                                          SHA-256:B16CB4FE0CFBB67C5FE2908B3EB374863E7BA0F62266D902098DD71F828B03D9
                                                                                                                                                                                                                          SHA-512:AB793145168E9F8302AD192D265520D965817B39CD5ABA9BBB8FA7584AE35D45C07D89EBE22E6E635E37DBE2BBA6FA7BB98F4FB94DC661A7934AE107F6C0622C
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.}_H...Ep.......F.!...,S..,6%&............d(.[.l..;IH.#.....W...B.....~.....9..._..X.yI....m..1..f.X.s).....8..5.....vfd,.....6.2*hnw.!..N:.......V.T.?...:."c.\1...3..r.l.S.....4 .A.z...EZ...Y..d....VP..5..8.,c..6....8 + ...`.Z......7.E....P.."...H.*.7...I{...Mv\.O......;..L@..:.V.7p....T......v...._....*..k..u&..7....)|....FJQ.{%....E..._\..z...!.w"....E....=U.r......P&..K...T.y.....5.p1c....h......r.u..G..y.....J.V...Yo....".......b.../>.e6=a..Uh"n.....^..J7..g..%V...D.v.......a..FB.O.TOE...;.... ..vo.y[...I...u....$.....o.XC.\.............K..n....m..Z(........W.'J..>.\.Yrn...>.t..S.U....I...@.[`..F. ...+.u{h....._@....S.D...............$L.....|..@..S=[...QR..;i.=..<...pYY............../......q.\tFF....x.%u..J.j.......vl.9;/.u.&!...}_%._....%.R....oeqU?r!...2V..,....8..8O...Piq<.S.\.....tT........J.24.A..KM<.4...V1d...w|]....nw.oKA.*...Th.2.^.SK.........H.X.J..Kv..]*.....-.L,.G..k.....h@.....YPf.F..r..d.#.m.9Vj.6.o...I.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.589610114261429
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7FutGwtIGjFKRnhI7nOSeM0TjmIA8nQJ+MQ3NWxO:JutjIGjUpayXAnJaWY
                                                                                                                                                                                                                          MD5:1004136C5BC51AB2D5B824883EE73BB1
                                                                                                                                                                                                                          SHA1:7925C54BD17B5317D3B412645FC3FA88F068B4A8
                                                                                                                                                                                                                          SHA-256:D4C2E596A754CFA45E517D0581B84063AD7CB0A5C9A99ECDE7CF3F1D1C519AB6
                                                                                                                                                                                                                          SHA-512:80568D348B95D76185EDEFEFEB50EDB6531FD69A6218848F0BC91A8EF8972BF1A2B838848B3ABC08189FE8CBD74BF20F8DEBA1DD2BADCBF441071F461CF741BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................@............@.......................................... ............... ...7...........................................................................................rdata..y...........................@..@.rsrc........ ......................@..@...............[........]...........RSDS/.h..Q.B...4}W......C:\vmagent_new\bin\joblist\260481\out\Release\fr\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):88120
                                                                                                                                                                                                                          Entropy (8bit):4.612399620812627
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:vfdNM5q5mdMkMinwxnswwFT2yckIBxRjfteWhAg5ae3RtRk0W3ee9K0MeKgtGDG2:vFS5cVUTyq8jftVtte9we
                                                                                                                                                                                                                          MD5:1185F218E284279854792BB27F262C63
                                                                                                                                                                                                                          SHA1:0895F155F8C87CC557D230337263F558748643D4
                                                                                                                                                                                                                          SHA-256:307A151F663B808AFA6D704A13CBC0127D8903D658EB3C7E21198F4902A49F04
                                                                                                                                                                                                                          SHA-512:1D96E55C71C39B1350C2D2C5010A61B5D846F28B4BB95A742F6E4850A75977F3B5FC902DBF5BAC9708AE165D19D897ACDD1C09D09BE2688326CBD2F280B3D28D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..x...x...x.......x.......x.......x.......x.......x...y...x.......x.......x.......x.Rich..x.........PE..L......^...........!......................... ...............................`......2.....@..................................!..<....@...................;...P.. .... ............................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):79976
                                                                                                                                                                                                                          Entropy (8bit):4.51109358050736
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:uVV4VfF3JTZdMkMinwxnswwFT2yckIBxRjfteWhAMae3RtRk0W3MWD97xk3whAnd:22TcVUTyq8jfVVtnuVkghAd
                                                                                                                                                                                                                          MD5:FF5EB1D682BB78A2B8D3AD1B5081D86A
                                                                                                                                                                                                                          SHA1:0F13669DE102C094638A61443FE6BA2CBC3820E8
                                                                                                                                                                                                                          SHA-256:B7E910C5E5D9063816603E108ACAA127359D26EFE6B6A34797E59C49DF6F48F0
                                                                                                                                                                                                                          SHA-512:E899D4448495ECEA4A8C588F7C28EC4F1954A8E7E1B035481DDB026E7A3EAAD62C26BD61B4633B8ABD751FEB35E4BA5F48D0044B4AC19A94A76C30746276B2A3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....06Y...........!......................................................................@..............................................................5...........................................................................................rsrc...............................@..@....................................................................0.......8.......P.......h...................~.......x...................................................(.......@.......X.......p...............................................................0.......H.......`.......x....................................................... .......8.......P...................`...h...........................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):64056
                                                                                                                                                                                                                          Entropy (8bit):4.988869253336324
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:XfdNma9UuMCMqKG+x/Hrx8y79hobSbF3IARQ7uOPpy2DC9K0MeKgFHDGaFoW:XFY0KDhX33pQ7nDC9wef
                                                                                                                                                                                                                          MD5:75924A26582CD5CA763C8742E971BBA3
                                                                                                                                                                                                                          SHA1:B84130902FAE31A5E5F252BAA11BEA352B577316
                                                                                                                                                                                                                          SHA-256:69C9AFED429233571166B89A4A55973F68310B368602E69E6D305014DFDD00C4
                                                                                                                                                                                                                          SHA-512:AF97F299AEEA3E9CF12342971789E2FD4AEE4E2FD3B4FBE092CD9EB8E59F2C75F32B77ABE3ABE2C22BB3CC8900AB60854DB3057D07818821BB214175B0502479
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..x...x...x.......x.......x.......x.......x.......x...y...x.......x.......x.......x.Rich..x.........PE..L......^...........!......................... ......................................G.....@..................................!..<....@...................;...... .... ............................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\deepscan\dsconz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19091
                                                                                                                                                                                                                          Entropy (8bit):7.991439008115141
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:384:uAG4Spbdq5EVT3GAlvnT6yUNywHXJSG5SxLWPdFO/BaRh:ObdAEkAZFUxXt5SxLWPdOaRh
                                                                                                                                                                                                                          MD5:9E6FEF0BBBCD82F2CFE7CF25CFC44FF5
                                                                                                                                                                                                                          SHA1:1169664042A453DAEF070F762A03C600CE889BF6
                                                                                                                                                                                                                          SHA-256:BF3585246CB2A0ECC4C987578209BCB651A0590D6FCAE11466A8D83B18F0E4FC
                                                                                                                                                                                                                          SHA-512:8638DB6862ED5DF11615F5A48F5837D41DA80395D019A09C99735E95B5502D81559B7494D8609390780F4B0CEC02AFCF66CD1281B29B8064B0975942791C8A19
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............WJ.......M..8X#%........L................LLLD^.HLLLLLLRLEL.... ..{.....5lG..]jo.{[T....._.... ...B.+C.|..D^..H..R`.I[...BM....9.~.x.N31...pK...U.O..''z...w...XA...P...5X..nP..$.DdP<VdF.`d.V...&....h.y.b]7..P}...~..3..3...[c....1..s...[............j.....P.v...i.H.t......d.4.Q.V.KJ%......q....j+.3...b.i..[.....8...Sdy.....L81Dw5.9.%...9...5..!yk..H.IV...6.q.VW..G.3{&)E..{. ..v|K$.....E.gC@a...<t.....cy.4...~..r.$bH.Y...L...F..gN..O....6p..We..N...r{.9..;=.%..O..%]=..J.Y=#...//U.=>...F......G^........p.........c%.a.I#...G...8..8.or......!....o.S..6...L......1.c..CM.m...R.^.[:.@.0..6.j.v..A..#.&..+-..C...E.}./T...>...F......C..A...<^k.{Q,.2xaU...C%%U..m.....<....D....@.~.p......D...=JJ..q.G@...It...TI...?~.._._%5...L......ns.Y..k.....g..............XW7..CzZ9....ce@..M.....d...H9qB..J.%.......t...(.t.....5.i.2h).jK[.B3.\U.hW...aR.....sN.>..B.I:...n...3.U'.3.2.&......%-...dSM.,.Zx0..G7....myc....l...,.=.;d..f..l..|...!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60403
                                                                                                                                                                                                                          Entropy (8bit):5.392847591907253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:vAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAA:JM4A6UAHRHF4aImg
                                                                                                                                                                                                                          MD5:504461531300EFD4F029C41A83F8DF1D
                                                                                                                                                                                                                          SHA1:2466E76730121D154C913F76941B7F42EE73C7AE
                                                                                                                                                                                                                          SHA-256:4649EEDC3BAFD98C562D4D1710F44DE19E8E93E3638BC1566E1DA63D90CB04AD
                                                                                                                                                                                                                          SHA-512:F7DD16173120DBFE2DABEAB0C171D7D5868FD3107F13C2967183582FD23FD96C7EECA8107463A4084AD9F8560CD6447C35DC18B331FD3F748521518AC8E46632
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<.......................................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):26176
                                                                                                                                                                                                                          Entropy (8bit):6.265967061889498
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7RM5G3mlhU85M0qI76eR3KJ1MORXDGPhCWov05MQ3q8:NyG2PU85M0hb9KvMEXDGto2
                                                                                                                                                                                                                          MD5:A7D0FA3B56E58C336931642F2F1164E4
                                                                                                                                                                                                                          SHA1:C36E7BC98909B343BE91D84BC51705BCA5FB4384
                                                                                                                                                                                                                          SHA-256:A30728F84CD71E37C6710163DB33FEB90C3669524510185DE994347056E0B448
                                                                                                                                                                                                                          SHA-512:9A06CBFC42B3AB8D1E3F7205AA43D37F6ACBBD5C40543520EDC364A0B62BC18220CAC4996ECF1978F1A711E1491CE2A8DD06546A5421807CA5E2C52B76A9F705
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........*...............................................P...... .....@.......................................... ...&...............7...........................................................................................rdata..y...........................@..@.rsrc....&... ...(..................@..@............. ._........]...........RSDS1..h\..@..c.l.e.....C:\vmagent_new\bin\joblist\503376\out\Release\fr\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17512
                                                                                                                                                                                                                          Entropy (8bit):7.153078301841618
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7GQXvXKqnNnI7nOSeM+UJjr+5JNNzFwhhiWl:NXvXKqNIvVM3wh
                                                                                                                                                                                                                          MD5:4DCEC790B7AA02A93691212AB12A5254
                                                                                                                                                                                                                          SHA1:3A789BFDC64BE7BBB509DC5FC4DD1820CB1115D6
                                                                                                                                                                                                                          SHA-256:67F99F6C0E4D3D50841202670A8BC08C961BC763C7D12D5F273682DA89F882C4
                                                                                                                                                                                                                          SHA-512:F4026335DA5341B910C59DA79305394E2FCCD1DA24E41B391C0EDC8E3620B562392D80F8DE071581817AC9E79728582F7FCD70CAE094C1B136D4144DA1B32988
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...v06Y...........!......................................................... ............@.............................................p................5...........................................................................................rsrc...p...........................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...^...........................T...................@...............Z...................................E.x...c.u.t.i.o.n. .d.a.n.s. .l.e. .s.a.n.d.b.o.x...E.x...c.u.t.i.o.n. .d.a.n.s. .X.P...S.h.i.e.l.d.".G...r.e.r.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17512
                                                                                                                                                                                                                          Entropy (8bit):7.15005081085858
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7d/MxtUenxj/7I7nOSeMYDBUjh5JNNzFwhhiiv:hkxtU4xYMKn3wh
                                                                                                                                                                                                                          MD5:9D9F13DE112AE48F638ED8AD5C392F42
                                                                                                                                                                                                                          SHA1:ABAAF408412C3FDC525CF06A62234A0F6AFF364F
                                                                                                                                                                                                                          SHA-256:8F32E7F32C643C981CE2536AE36C9BABBBC66A8BF3B41AA2692D3F945EFAEAC1
                                                                                                                                                                                                                          SHA-512:BE2AB2CA105669A14D3F66BF01EFAA8D1215EA84D209EDF6A6E162950DCD9721CC783EEC58DB1674D734883E8DCDE9E75CD78D208CE41EF044AEE7295FDA392F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....06Y...........!......................................................... ............@.............................................x................5...........................................................................................rsrc...x...........................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...^...........................T...................H...............Z...................................E.x...c.u.t.i.o.n. .d.a.n.s. .l.e. .s.a.n.d.b.o.x...E.x...c.u.t.i.o.n. .d.a.n.s. .X.P...S.h.i.e.l.d.".G...r.e.r.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21984
                                                                                                                                                                                                                          Entropy (8bit):6.275831085216632
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:788+9ZzizJj27gJ7lDluaTAZh6ki2cP0iwfLdD6S+ShjmM6IGBkSN:9AaTAZU2cPfwIS+ST6nk2
                                                                                                                                                                                                                          MD5:0383AAAAAD4F7A7F9353AB9BC92A7761
                                                                                                                                                                                                                          SHA1:A2058D4E2CB2C58468C3D305C4E8CF1930F88B02
                                                                                                                                                                                                                          SHA-256:4E2173BEDF061BBD80F89A9428C3EE49275CB1E3865FF6F03B80C80E6324D7E5
                                                                                                                                                                                                                          SHA-512:CF60000C44EC1C7B5DB9170C78ABDC1E52369B6816A44EDCC7964FF574F54B5C55B106ECB2664772224DE1D4012F7A8465F8966473972CECCF893BF408CE04B4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........(...............................................P............@.......................................... ..h$...........,..H)...........................................................................................rdata..r...........................@..@.rsrc...h$... ...&..................@..@.............#pf........V...........RSDS.>e...C.e^.......C:\vmagent_new\bin\joblist\815456\out\Release\fr\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19936
                                                                                                                                                                                                                          Entropy (8bit):6.4332479648993575
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7xlW45+9llF2BjhlBR6ki2cP0iwfLnWkS+ShjmM6IGBkSyGS:meBjhE2cPfwJS+ST6nk7
                                                                                                                                                                                                                          MD5:D168802F9D5E296F621C567FFD7B7B30
                                                                                                                                                                                                                          SHA1:4533349AA1CE78C93B92BBF36ECFD282FE0A950D
                                                                                                                                                                                                                          SHA-256:2B168AF81AF9DA787E90F1EBABECB5A0A892036B3DB250712D5D0D8829F7CAF1
                                                                                                                                                                                                                          SHA-512:B614DE907FDB0F2891218F7CD8EFAC6EEB49D491BBD73CF9ACBB1AABFBD16447AD2BBF4829C595101D3F4DDD66BB72D645F2FAD801D33834A9348ECD4F3D625B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!......... ...............................................@.......k....@.......................................... ...............$..H)...........................................................................................rdata..u...........................@..@.rsrc........ ......................@..@.............#pf........Y...........RSDS..z.`f.J...........C:\vmagent_new\bin\joblist\815457\out\Release\fr\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.968514351588424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:5vHP8qNfXOKM5VHblx1qhvmVqC7exscB3neUvESwTPprqWPQTUDnwENL1c:hHP8KX5M5VHRivmsCescReUsZPqid8
                                                                                                                                                                                                                          MD5:BD29091BA65B3FC08C79654997B4C82B
                                                                                                                                                                                                                          SHA1:3B353EC41DCC96D898715F6474656F13931C1B61
                                                                                                                                                                                                                          SHA-256:A3CFC3C8F95F0ED56306D28AC87408F10875C43BCA7778C6E1CC18C7A3441183
                                                                                                                                                                                                                          SHA-512:AE64DAE0E4025968BFB14E57C2FAAB0C9DA39943DAE9C884CBBD940433B29613C090B98899DB847C94B265F969A6ED3CFEBFF35AF284CA9619E6E25937067650
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................A..a,.@.-_...#.....2..vI...^..2..H"..........yU.;.i[..{.~:p.u.!...&..JnZ.......)px...@-T......7.HK.)...Z...[@n,4..h.C.!....#..w%..w.`...0..$................0...............q.%H...CK.d.d.=\I...).../..UQ.9z..@.(..gc3v.... ..v..+......`f.~.z........o+..}..az............(-z......3.*..7>T8O...._='..P.hX.....Itvz...r~$.....r.3....L.e..H|. z>x!;C..J..a.=..c$.....6..6..._s~..b"-...!.fI.&....w.]b......+....b...U./..m.6[.o.DS...=>..._C8.Av..yy.^*Sh-.s..Z......w\.n.;...q..h..Q.....<..V.........t.....4.6..F..=Q*..........0B..h.ja..=......|..>dz.,.)......&.......3..|..;]"q..A......R.y{.......$.d.L.:.......]j...G./<mFJ.!.,Lc.....Fcvw..{4.SH.*..m..l..|.?`N=d.l....O..y~....u9..?s....Jy..P

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32908
                                                                                                                                                                                                                          Entropy (8bit):7.98579519717503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:mqPy0zBxmlBLCxBIZuPVOWdT0bQUu9d2+8Pc1fCrGrP:m90nmlBLSBjt/T0MUu2ofCrY
                                                                                                                                                                                                                          MD5:F507C8DB8F8EC9361F36608408C9939E
                                                                                                                                                                                                                          SHA1:F3915EDB67FC281DDE5657B383E3A5AEDFE96BB8
                                                                                                                                                                                                                          SHA-256:DAB50E3C2787808BEEB0B377AD7C3DE2C518578B9F7A4EC4AC29063D59C00B3D
                                                                                                                                                                                                                          SHA-512:CB09E4F033B873211BFA8B8B82FA207EA5C176D8D686487C2253214F5F965734D2A16A04AE41B849FFA20B3B03814714274B749F07DBC28A0A5676A86630FEEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................r.e.g.m.o.n...d.a.t..............................................................................................................`1.!.../.C~.}.Q.i.{,..L......B.PG...xJ..L#.......B#.5J?.j}..f..`x.F.dG.p......."...VOn%.%M.D.;.F;.XL].o.S.DK....F[.....]....#..w%..w.`...0..d.6..............0..........X.6./).5.b..V..p,...u}".~..t...0...r..6,...c.....y..>.....lxh.t...O...-}~.c..1.'zv:..s..t^.|....%.."k.c....n.....J..x&. ._.-...\.9>.$.q.).~........v...b..IY.{...cp.f5..F.&..o.].V....0..J....w..f].%...!..\t.s+.J}....7.X..nI.z.M0...5...)x.8\G.._..w@.'..1....?=D.y.:Hw...9.@.Y.9.hd...$h^..I.G..gy..j.......5...nB.4 0!e..N...WQ.k....:x.9.`........3....38...W[..K1..{Q`..5P&z..8.J<.`.'+.i.y..0.a"Zu......KS......M..h...O..qbj..$../Z.M&...;...`..n.>..#.8. .m...|...s.$.K.T*c.....H.Z.S...P..5..#....^[.a=...........V.k..)r..%.i_.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17888
                                                                                                                                                                                                                          Entropy (8bit):6.733339640230767
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7fbkyK4ckx73m6ki2cP0iwfLjcF3lS+ShjmM6IGBkS+:H352cPfwES+ST6nkp
                                                                                                                                                                                                                          MD5:1F7A45552AB1426DC11906016AB33020
                                                                                                                                                                                                                          SHA1:EFF2B9CA5C00F7B2ECA2D459FB3DA97712C40FCD
                                                                                                                                                                                                                          SHA-256:0733A14D9915E5106AD75A721B3B06388BBC0752000F5F21F40B2937CC648ED8
                                                                                                                                                                                                                          SHA-512:DA8803526B7B7D0C76273EC2F696B499779D890A0AD405829D20976E3C226FF819375866A91BAA0FE2A920259769217F028660537A4AF72E89D3F6F8C71374EC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...bfrf...........!.........................................................@.......u....@.......................................... ..................H)...........................................................................................rdata..t...........................@..@.rsrc........ ......................@..@............bfrf........X...........RSDS3k.....F.C..(..}....C:\vmagent_new\bin\joblist\815994\out\Release\fr\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1062, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1087488
                                                                                                                                                                                                                          Entropy (8bit):6.836303762168074
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:IMMMG16QFvYoSrB23IFB9xJBgngj5wB8B3phzpGhbr:rY6SYxB23E9xJBygjtO
                                                                                                                                                                                                                          MD5:868A5BEED8EF699C997BAD0599A8FD21
                                                                                                                                                                                                                          SHA1:774321C869A482E42EBBBA8D588DDDD3C074BB8E
                                                                                                                                                                                                                          SHA-256:E3EC36EBC0E554C57C1F2251BCB68F2D5B1B5FE29CD232F5845631382C26AF8E
                                                                                                                                                                                                                          SHA-512:8E47ADFB5DE919977A35DBC34394F746CD6E3E3296C9F6A6A36BCCD8A8295F911D2628FB9C8E0106336C3A53DE3B1ADCCB4B2B6046EFD7F3268C75D5DAEE3C96
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......&.................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 237, database pages 791, cookie 0x8, schema 1, UTF-8, version-valid-for 237
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):809984
                                                                                                                                                                                                                          Entropy (8bit):5.831830221568559
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:g/nCExkRpiJhfKNJhhD5PpS1t/PUdmuisxaA8Fsf3:iCExkRgJhfKNJLhctnUdmuTaAN
                                                                                                                                                                                                                          MD5:59142076FEB5C4C0F3E11C1E038D1A83
                                                                                                                                                                                                                          SHA1:EEE53BD52544DC563DC237F02127F4FC125BC247
                                                                                                                                                                                                                          SHA-256:5A0B7B0FA4BE31AABF8F249D398E8EB8387485CEC93AD3C2758952C97960C96F
                                                                                                                                                                                                                          SHA-512:7ADEAE6EBFA44820112BB89FC9556EE01D97EC168C59D6AC5D1463EEF1C95B15B3B1CB7622F3364BE4E3DBD4928FA3AA9A785431C39609E51A126E7907D39446
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.........................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21096
                                                                                                                                                                                                                          Entropy (8bit):6.750626144429076
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7JGZuPMyeFR8qI7nOSeMj7tyj3Y5JNNzFwhhi:gZuUy1h3h43i3wh
                                                                                                                                                                                                                          MD5:63BFBB289632A1E8B98FB6464A83A517
                                                                                                                                                                                                                          SHA1:642B6B5806CF25701F03389AD74574EEBFED0087
                                                                                                                                                                                                                          SHA-256:F0902185C36E5C7166D066C10D91359FD31208EBB25EE5340F77D38359EBF473
                                                                                                                                                                                                                          SHA-512:074EF7C481BDD5BEC894420B22515FE4EDDB5520EC3809B36AB35FD67EC21D7D72FDA2E2B5D35D6B5CA41D36D296B1EBD2D7134ECA339177E6403F7CDDB398A8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...l06Y...........!.........................................................0......=.....@..............................................................5...........................................................................................rsrc...............................@..@....................................................................0.......X.......p...................................................................`...........................................................................0.......................@.......................P.......................`.......................p...............................2...........................|...............x!...............!..8...........0%..Z.............................3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y.{.S.i. .v.o.u.s. .d...s.a.c.t.i.v.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2146
                                                                                                                                                                                                                          Entropy (8bit):3.6593846073268637
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uNYWgXYeg40egL+r5gC4BYegeEaggnyULj1eg+K3Fdg5egl498fqIo:r3N+oc6FLP1dxCfq9
                                                                                                                                                                                                                          MD5:36021FDE33F9A7DB27A68EDEB1E573FD
                                                                                                                                                                                                                          SHA1:0BA192FCA03200822C1CC36B18FB004828B2A284
                                                                                                                                                                                                                          SHA-256:6E52647EFF76F0CC5ED91786D654DC000F08CD6E5FE2234286D9D4BFBFF07BEC
                                                                                                                                                                                                                          SHA-512:62B9A80057603EFB6E4E247ED353049A2BF1F850CC363CABAF1A8F17FBAA2D79D0513D38940854E380044A73DB0E6B1FA51DEFBAE769598CB0154A3F8419A211
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=.U.n. .p.r.o.g.r.a.m.m.e. .a.c.c...d.a.n.t. ... .v.o.t.r.e. .w.e.b.c.a.m.....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=.P.r.o.g.r.a.m.m.e. .s.u.s.p.e.c.t. .q.u.i. .a.c.c...d.e. ... .v.o.t.r.e. .w.e.b.c.a.m.....I.D.S._.T.I.T.L.E._.R.E.D.=.A. .d...t.e.c.t... .u.n. .c.h.e.v.a.l. .d.e. .T.r.o.i.e. .q.u.i. .a.c.c...d.e. ... .v.o.t.r.e. .w.e.b.c.a.m.......I.D.S._.N.O.T.E._.B.L.U.E.=.S.i. .v.o.u.s. .n.'.a.v.e.z. .p.a.s. .i.n.i.t.i... .l.'.a.c.c...s. ... .v.o.t.r.e. .w.e.b.c.a.m.,. .n.o.u.s. .v.o.u.s. .r.e.c.o.m.m.a.n.d.o.n.s. .d.e. .l.e. .b.l.o.q.u.e.r.......I.D.S._.N.O.T.E._.O.R.A.N.G.E.=.A. .d...t.e.c.t... .e.t. .i.n.t.e.r.c.e.p.t... .l.e. .p.r.o.g.r.a.m.m.e. .s.u.s.p.e.c.t. .q.u.i. .a.c.c...d.e. ... .v.o.t.r.e. .w.e.b.c.a.m.......I.D.S._.N.O.T.E._.R.E.D.=.A. .d...t.e.c.t... .e.t. .i.n.t.e.r.c.e.p.t... .l.e.s. .c.h.e.v.a.u.x. .d.e. .T.r.o.i.e.,. .l.e.s. .v.i.r.u.s. .e.t. .l.e.s. .p.r.o.g.r.a.m.m.e.s. .m.a.l.v.e.i.l.l.a.n.t.s. .q.u.i. .a.c.c...d.e.n.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22120
                                                                                                                                                                                                                          Entropy (8bit):6.617731438958052
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7gpsrdJzrzel+ojjvGVQInbI7nOSeM5NjS85JNNzFwhhii1:kpQKlTv2rEVxh3wh/1
                                                                                                                                                                                                                          MD5:BDFE18B040B31CE5DDB95A0CBF45594D
                                                                                                                                                                                                                          SHA1:EE74DE3324EBBB80C5D5B2307FC8C0C53D139AE4
                                                                                                                                                                                                                          SHA-256:7679BA7BEDD3D4FFAF3F350A3CFBFAABF23B5D391E78DB20EE1C1FDFE484A2D8
                                                                                                                                                                                                                          SHA-512:E606AAD75B7B0CDCB9316238FC63E78C3D2C443008AF7A81994A5BB44B188471CC8DE0B731A5710C6B466142C243C623F652E4209E9B6D6F328C2409B2210454
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L..../6Y...........!.........................................................0............@.............................................h............ ...5...........................................................................................rsrc...h...........................@..@....................................................................0...............................................................(.......@.......X.......p...............................................................0...................`...H.......................`.......................x............................................................................................................................................................................................................................................... ...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):23144
                                                                                                                                                                                                                          Entropy (8bit):6.573622665325625
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7w58lPyZEXa5VJA1YPJ5LttVku+pdhh2Br0588aX3r9ZCspE+TM4rk3+Ea5ciwwY:7w5owVSazvI7nOSeMCjs5JNNzFwhhi
                                                                                                                                                                                                                          MD5:0F7116B2519C2D95ED9B93AF34E8F5CF
                                                                                                                                                                                                                          SHA1:91F1590845699B2B0298C16E7EDF4D7F28BF7D04
                                                                                                                                                                                                                          SHA-256:83205A49CF834B38DEA99ED7FBE451823234C8F6308725648EF6C562A2AECEB6
                                                                                                                                                                                                                          SHA-512:A9389F6EFD3DC7C4D611494AC57D19CC429445CEA1FCF8C5AA02C8684D5BC379933B31B6EBD7741E68C506349C3BA7E55450F19B42D6BA8CE4B54360A3EAD0A0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...F06Y...........!......... ...............................................0......_.....@.............................................P............$...5...........................................................................................rsrc...P........ ..................@..@....................................................................0...............................................................................(.......@.......X.......p...................`................................................................................................................................................................................................... .......................0.......................@.......................P.......................`.......................p.......J...............F...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21096
                                                                                                                                                                                                                          Entropy (8bit):6.7048747432202065
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:706huhpyGF/e2xNEPI7nOSeML/KhojGR5JNNzFwhhiO:BUhpyGxygvKQa3wh
                                                                                                                                                                                                                          MD5:8B33A3A035659528FB3D1A8FB1AEDCDA
                                                                                                                                                                                                                          SHA1:38741573F8A580945F3F573B3452ED6228B8F9E2
                                                                                                                                                                                                                          SHA-256:39E460CD1D2E0B0ED161EEE747AAA5987BCEF723480BE1104914AF3F4BAA1669
                                                                                                                                                                                                                          SHA-512:86146AD09D410345E222945403F394510A4A6D4E9BCEDFD56D0033C2DD63BE59DE100457737BC60B920A60421462F765DBB5A1EE9A6C4C483D20987336FD8340
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...R06Y...........!.........................................................0......i.....@.............................................p................5...........................................................................................rsrc...p...........................@..@....................................................................0.......h...........................................................................................`...(.......................@.......................X.......................p...............................................................................................................................................................................|...........l...............D...D...........................< ..............D"..............."..P............&..Z...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17000
                                                                                                                                                                                                                          Entropy (8bit):7.184358611916339
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:79Ep0SZ3fjc3I7nOSeMrvjV5JNNzFwhhizKeqy:ZEp0SZvjcYvrL3whs
                                                                                                                                                                                                                          MD5:3BAE95E828A72279CFAE44586767F433
                                                                                                                                                                                                                          SHA1:98C39B7FABA22044BFAD0731C7586FAD4BC3D7B6
                                                                                                                                                                                                                          SHA-256:C34BE80126AEE1CD84B3732309D9360A501477661F87EB08F7AC6BD5468B497E
                                                                                                                                                                                                                          SHA-512:CDCCCCC7B6DC8357AC8A5271A5FB565FD3AEC533C8022D3263828B93D6E5E8AA9DCA8D2737B2D60A4A573EBA35B47B2524F5C215974E0D4ABBA5C0C8FC0322BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....K6Y...........!......................................................... ............@.............................................H................5...........................................................................................rsrc...H...........................@..@....................................................................0.......H.......`.......x...................?.......................`................................................................................................................................................... ...0...............................h...................Z.............................!.P.r.o.g.r.a.m.m.e. .s.u.s.p.e.c.t. .d...t.e.c.t... .s.u.r. .U.S.B.*.0.=.F.i.c.h.i.e.r. .s.u.s.p.e.c.t.|. .1.=.F.i.c.h.i.e.r. .r...c.u.p...r...|.2.=.%.d...........PA

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19512
                                                                                                                                                                                                                          Entropy (8bit):6.980294454004556
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7PmlSBeR3K+h1MeK6ja3DGPhC0GCov05MQ3:ql/9K0MeKguDGXo
                                                                                                                                                                                                                          MD5:5B8A6305BD03E499DDDFCB39ACBC28E6
                                                                                                                                                                                                                          SHA1:F9E03E882553F92D1FF446FC06D324B7F816F61F
                                                                                                                                                                                                                          SHA-256:D5F222D8D0513A9485AC3A6E924B84876924F441941EF37CA1F86A50781FEA6D
                                                                                                                                                                                                                          SHA-512:9B723C68B74B6E7892ABF8164AB6B497F0E46FCA657FEFB24A27F674F69DFB0C122C14B4B6F7073456D13D430A6DCC5AA672FA9C9DECCC1A9F9079B9E773089A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... ............@..............................................................;...........................................................................................rsrc...............................@..@....................................................................0.......X.......p...................................................................`...........................................................................0.......................@.......................P.......................`.......................p...............................8...........................................................L...p...............Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................C.h.r.o.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):23144
                                                                                                                                                                                                                          Entropy (8bit):6.572309271049448
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7G5o3Vp+hxdI7nOSeMRjAMH5JNNzFwhhi5Rz:y5oFghx+RAMd3wh2z
                                                                                                                                                                                                                          MD5:F111BC3924A124DEFC9FBB5CE874A870
                                                                                                                                                                                                                          SHA1:A1FA6C0F12C2AAE1C5665D49FD1334A76E40FBF1
                                                                                                                                                                                                                          SHA-256:B5CC42AF6C3C5B84B78DCACA06A4D5424AC24F72E59DA30420B855909A64A86A
                                                                                                                                                                                                                          SHA-512:D61523660D19E73012407B7297E0F308C0E7D05C0BD61DAA4B82D0E0BF5459FF63759E4082948A57635A167C9DE90E2CE0F6375BF0351D7914AC6C5950B6CF4D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...:06Y...........!......... ...............................................0............@.............................................P............$...5...........................................................................................rsrc...P........ ..................@..@....................................................................0...............................................................................(.......@.......X.......p...................`................................................................................................................................................................................................... .......................0.......................@.......................P.......................`.......................p.......J...............F...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17512
                                                                                                                                                                                                                          Entropy (8bit):7.143977219133379
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:79rhmhyTI7nOSeMG6W2j485JNNzFwhhiy:prhAysrWUH3whh
                                                                                                                                                                                                                          MD5:C3C563A8A35D95F359F7992CB98E2B6F
                                                                                                                                                                                                                          SHA1:9DB4690373CB59F7D54E286FA57C61C6E82BD2B8
                                                                                                                                                                                                                          SHA-256:58B205EB51FF539734D22476B867943377CFF4D1A30FA55DB0E69156CB81F183
                                                                                                                                                                                                                          SHA-512:ED402CF74C9C223AC24FBB03AA12C34AAF8AA25DE2F3FAB39519422BD5BC31334D229C55BE7E4882A3D2AED6D7D0B5338B5358266AEA144A4CDF75818954609C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...Y06Y...........!......................................................... ......h.....@..............................................................5...........................................................................................rsrc...............................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`............... ...B...........d...................x...........\...Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...N.a.v.i.g.a.t.e.u.r. .S.p.a.r.t.a.n...N.a.v.i.g.a.t.e.u.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17512
                                                                                                                                                                                                                          Entropy (8bit):7.137175697919079
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7tZjtjuCI7nOSeME7jQ5JNNzFwhhi4rC:BZjpupaa3whfC
                                                                                                                                                                                                                          MD5:33737A79EAC8A6838ACE20F88FDB2190
                                                                                                                                                                                                                          SHA1:79CBFEC77EB2BC63786DB254BA8338477E083BF8
                                                                                                                                                                                                                          SHA-256:6E699811D5A1F66F505D89E0EC2919BC1740DA5E9B23DFD6C6941E6FB7248905
                                                                                                                                                                                                                          SHA-512:C3998898C190E6BE7BA2EF04B0ACE4EA4C66E5893B9849308E42B8864D7857F7825EE95D32969B73533A56A835E18F47C5AC981A63B9F64A7A2B04860B7D1D92
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...`06Y...........!......................................................... ......YK....@..............................................................5...........................................................................................rsrc...............................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`............... ...B...........d...............................d...Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...N.a.v.i.g.a.t.e.u.r. .S.p.a.r.t.a.n...N.a.v.i.g.a.t.e.u.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):480
                                                                                                                                                                                                                          Entropy (8bit):3.698357672065705
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Q++ubxPR/WBg0GQ69kWx9hR48R/WHgEliE9smpAuHE9mXXo6:Q++u1RV1f52ZzvpAuemo6
                                                                                                                                                                                                                          MD5:0AABF786B8156D4D6B7765BB71C95736
                                                                                                                                                                                                                          SHA1:B95BA632E677766B86295E2D799C557DEE0A4DD5
                                                                                                                                                                                                                          SHA-256:A3D6AE52A065176108539AD567391B31A6E4AFBA5115FB4B70A9F33D6B5585CE
                                                                                                                                                                                                                          SHA-512:D4E3217ECA3863766FB8C6BF6E124DD1B4D087D45B59249D66F2E4D5237847411510D166B3422108BCB82BA7869BEAF748DB61DE80FFAA9E8085408B4B5012DB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=.N.e.t.t.o.y.......I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.F.i.c.h.i.e.r.s. .s.u.s.p.e.c.t.s. .s.u.r. .c.l... .U.S.B.....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=.N.e.t.t.o.y.....:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=.R...c.u.p...r.e.r.....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.D.o.s.s.i.e.r. .c.a.c.h... .d.e. .c.l... .U.S.B.....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=.R...c.u.p...r... .e.n. .t.a.n.t. .q.u.e...:.\.n.%.s.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8506
                                                                                                                                                                                                                          Entropy (8bit):3.558613874454418
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVl9ENqWIajuwapG4i8nc6WSbJ1J9Wd6AFWbmc:29+DgRg2zMG4i8nxWHFWT
                                                                                                                                                                                                                          MD5:939EB85395863FD79080046B3EFE4336
                                                                                                                                                                                                                          SHA1:6243A537E855A1F877AFD6FF58F55ECD06D10A7D
                                                                                                                                                                                                                          SHA-256:49A51D5707DD3331576780EECBE095E90E60F833A1C95A318EFD47EB0D12A429
                                                                                                                                                                                                                          SHA-512:FADE79216A7930BDE6F1D89BCC8FB650C3DB208E0689973D993D7C358DF5F1D2620ABDADEED1D167F966460976CC3860D093D55DD18446B944153B970907FE1C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.3373975079610023
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsXg6PCabR:r5u5/+mMks5qTp1mNqce9Oow6aabR
                                                                                                                                                                                                                          MD5:E315796741AA16C306E0BEF23A45B9C8
                                                                                                                                                                                                                          SHA1:942C0D9FBA70C745A5B60A0DC70A638C663F6F2A
                                                                                                                                                                                                                          SHA-256:E98D9F32F79C3D9CBE82C986A96B23E754B123F1435F1178388BA80FCA5403F1
                                                                                                                                                                                                                          SHA-512:6BFABB00D8F1819FDC7714A018002CCCAC0D0A4147CAD83060FF00AEBE5B5E99F82FB86F8A4617B6E6698065A1ACE90897276DEE53AB4C0A6BFF1DB12F190FA6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\fr\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17512
                                                                                                                                                                                                                          Entropy (8bit):7.091203778539932
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:772criFLI7nOSeMUYjqjQF5j5JNNzFwhhiM:n2Wa0w2hFX3wh
                                                                                                                                                                                                                          MD5:8BBA93DB83F11291C3F6CED45A68739C
                                                                                                                                                                                                                          SHA1:0A9F67E6341C65C02E629960014DF57D3E92BDA5
                                                                                                                                                                                                                          SHA-256:93AE225B437CFB70F8A5607C039EC1BB6D38EF9FD31A5D81ABC16699A471B34A
                                                                                                                                                                                                                          SHA-512:34663F60C17A8029DF75397B967FC29C752148CB8B6B8881F5A7C72A92E3199253C5DFE40632A0F1FCD11AC644A5CD4E61135C4DF46C4BE29EEC8CE2F8228155
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L..../6Y...........!......................................................... ............@..............................................................5...........................................................................................rsrc...............................@..@....................................................................0.......X.......p...................................................................`...........................................................................0.......................@.......................P.......................`.......................p...............................8...............................................................x...........|...Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):132168
                                                                                                                                                                                                                          Entropy (8bit):5.692153107369685
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:dhrRouVO1mKil9fZ80t5TVxFDvpkoQbz0m/INEx:7Kil0gRtgbTGa
                                                                                                                                                                                                                          MD5:85B5FA3BE8829B642F32FA8DE120A003
                                                                                                                                                                                                                          SHA1:BDEF663810C248608E8101786B47E45675B33816
                                                                                                                                                                                                                          SHA-256:0B3C710EF9A640860F34E5CF1D492EA79735E9D44B69E8EBD02C781D12B7E407
                                                                                                                                                                                                                          SHA-512:3D21524FB072C13A61DB2C6D5288B0182631ECBD943D37F11587A31E52F347ED5C1032E65812AC33FE4D1730C2718BF807170BA8BF03F43641046703DCC78746
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L.....[...........!.....d...b......B................................................U....@....................................(........)...............7.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc....).......*..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with very long lines (323), with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1812
                                                                                                                                                                                                                          Entropy (8bit):4.213526306897906
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uLTDDpVC9AgN2GqkzVwZGdgTTRROk54xHVelY7Mshqm2egn:r3LTDtVujYGXJwZ132e4xHMlY7Mshqmw
                                                                                                                                                                                                                          MD5:74102B194668BB8AE8CB4F4910530AB6
                                                                                                                                                                                                                          SHA1:FE775291AFD1E4985552087044C8004511C0D497
                                                                                                                                                                                                                          SHA-256:4AB9E8F5D282C2CA25C2CFA7E864F7414A590B777EA2EEF18C70AFA564DFDE7E
                                                                                                                                                                                                                          SHA-512:8AB1F20C776A10AD7F2B58CFF02C091CC73C22286FCE42D2C2A490ED5C785A98794079AEDE15647DA0A79B71792CB231FDD0C138C0A51F68CB23F6A06B918D9C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y. .$.M.0.A...?. .0.?.*.K.0.M.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=...8...G... ..... .....-.@.0. .8...8.M./.>. ...>. .*.$.>. ...2.>. .9.H.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=...?.8.@. .-.@. ...8.A.5.?.'.>. ...G. .2.?... .9...G... ...G.&. .9.H.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=...*...G. .&.M.5.>.0.>. ...*./.K... ...?... ...>.(.G. .5.>.2.G. .*.M.0.K...M.0.>... ...G... .$.M.0.A...?. .9.A... .9.H. ...0. ...8.G. .,...&. ...0.(.G. ...@. ...5.6.M./...$.>. .9.H... .9...G... ...6.>. .9.H. ...?. ...*. .9...>.0.@. ...A.#.5.$.M.$.>. ...K. .8.A.'.>.0.(.G. ...G... .9...>.0.@. ...&.&. ...0.(.G. ...G. .2.?... ...(. ...>.(...>.0.@. ...K. .9...>.0.@. .5.G.,.8.>..... .*.0. .-.G...G.....G... .9... ...G.5.2. ...G...K.0.@. ...G. .....&.0. ...@. ...>.(...>.0.@. .-.G...$.G. .9.H... ...0. ...8...G...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\LibSDI.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):104652
                                                                                                                                                                                                                          Entropy (8bit):7.998122927758479
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:j7wIE7URKxAN4Oc3iyf8XaJySAxDO/Uxrn1X:47URKxOSd8XSy9xSMxrn1X
                                                                                                                                                                                                                          MD5:6E31F13A0F36C35C2B5DDA4915A0B4BA
                                                                                                                                                                                                                          SHA1:998267FCFDD97C37130CDA51B4768A73D4FFF10D
                                                                                                                                                                                                                          SHA-256:8F96C00D97435B6630706AEE0B8D65BDC88B3E692050DFEE6FC532A0AC5445D9
                                                                                                                                                                                                                          SHA-512:32AB023334596E1704A593E9309597781060B2676DF1A181DF35285DBDCFF9AC5A34129882A592F099776C156C3838F6BA967907D471EE83CB6A3F393511BDA0
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.F.+-'.H..2..@.2:....9.!.]D)^._..")w.|...G...........@*y$Z.A.j.Z...r...%!e.1...;.%........d>$..6....[.)E..R....f...t.Z...D..r...../..ok..>..a....Ac...........3......LJ.^.H.3..w.]s..M.y+.k...Y..5v5....U@.".,.4,o.3.qp%"....I..,../...t....6...i..b.Y....IIv.E.zP9.{=..w.f..QJ)J).....bc,.m.s.5t.5f]._..y.Ue|2.t.R/..Q.E...+.8.........$G[.N.@s.........7.....R..%.."..o.VH...`.aD....DW.....Wp.......c...U*.K....V..*.U.2..5.q...@W...l...l!2.*4..J....8.,...a...D..d.i..u5...h}......s.....P!S.Rw.....xI.m..[.H.x.r......-u.......l...q.Zl!i.]..Wa.wQ.m.]|...Np.^X.-..B+..k6.VSN...g..<Lx..Q*.A.m.TA..q.Q..Z..Q..i..4.X...y.Y......d...BI~.A.....;S....,k..j.....].......O.............VU..d...g.r..Wn!.Z..l@1..~l.;?....3.z......t.6H.....fX.Bj{./..7....:.t..*..o=|..zn.<gW.q......dc.s.W.m...~.......uc.>1...H.@..,......f....T........[.......Sm..AjG...e{...k..8%g.....c.=...'0...=,..@.L.4W`.E.._e.,..g...s'y`.N.+.w.....@.+do!..".M..h.7.s*.x.M"&...;...h..\?>.m...=.....5..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.611926944408253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7n3tG3tDGGiSmI7nOSeM5yYajsA8nQJ+MQ3JZU:L3tKDGGiaty5sAnJqZU
                                                                                                                                                                                                                          MD5:0CEB7469B7B39A0B784D46CCF57200AC
                                                                                                                                                                                                                          SHA1:7F1DE56DCD3163DC41BC2103EC1E3FD548D3489C
                                                                                                                                                                                                                          SHA-256:6857EEC84039A51F1184C501C659AF54C496D4A4D59361251E026DD0CF295342
                                                                                                                                                                                                                          SHA-512:F4CD91D12B8BF9AC88037A4251D94E358FEAA5E438768E6292C4B1FA4F2041799BBDC875D6F0C4E4ADBDF86B3111AFD20B70F2938EB7995F6BF47DA1E24F28D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...V;.[...........!.........................................................@............@.......................................... ..t............ ...7...........................................................................................rdata..y...........................@..@.rsrc...t.... ......................@..@............V;.[........]...........RSDS.i....tN.td.W..p....C:\vmagent_new\bin\joblist\258920\out\Release\hi\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):113720
                                                                                                                                                                                                                          Entropy (8bit):5.886002274620672
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:Y2kLlARh7AFRobYPc25Q1O9FY9WEs/BA9wek:YfFRoCc2a1eYUEsC9
                                                                                                                                                                                                                          MD5:824EB2B66AB8A4551C28AF8E53C1C44A
                                                                                                                                                                                                                          SHA1:3C02C464D7CAB1180D67FFCA72E223F2DC075512
                                                                                                                                                                                                                          SHA-256:32D666899DB667284001A59B976BBAB3C0B1F68D9FAB2480550667F53858F1C1
                                                                                                                                                                                                                          SHA-512:67AB517B167378D9DF60E01C43B32762DC19675705216252CE3623C9CA5E9C0AD2856DB44C50E05F8BB67EE40C7EC4AE01E51D16F623D84B7C7FF1104AFBB4A4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B.....................................................@....................................(.......L................;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...L...........................@..@.reloc...............p..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106584
                                                                                                                                                                                                                          Entropy (8bit):5.706914739773108
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:4WPrlAMh74pEFRouT26PBY3NEY5rE5B+0s:4lpEFRouT26BYWYtE
                                                                                                                                                                                                                          MD5:4FB1D7CCAC4C6F50F8CAE4027EF5C319
                                                                                                                                                                                                                          SHA1:C11DD65582C46322F90BE0A96C4A988F26F509D6
                                                                                                                                                                                                                          SHA-256:5146A42B63C44D0CC8ECA86758012EFA11BA4F34408533DDCED0215DC488275F
                                                                                                                                                                                                                          SHA-512:FDDA1DC2BD0A842F6DB3CE5FAFB0CEFF0C43C87CEBDCEAD35655BC9CA913C4EC8C94F07B8240ED417C0457F46E64CF27305AD3F94F02BA2C7CDEE97D4D252119
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L.....-V...........!.....d..."......B................................................u....@....................................(.......H........................... ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc...H...........................@..@.reloc...............p..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):92216
                                                                                                                                                                                                                          Entropy (8bit):6.156654362774311
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:yimVVOWFbLpAEl6kh7lqFVh01swoMRocqg25QbCdh/lv0FvPLZVAFqfbVNlIBPO4:LmvblAch77FRoe25Q1B/IBPoY9we4
                                                                                                                                                                                                                          MD5:2E78BEB9ECB6D475F30FA4563EC14634
                                                                                                                                                                                                                          SHA1:2D171E12FEE4BA71B7C057DA776E8C804E5A2FE3
                                                                                                                                                                                                                          SHA-256:75B66C132FDF57AC469AEA1B28A13C206D13F55E5A31AE0F8E1E80A1F2FD11A3
                                                                                                                                                                                                                          SHA-512:8AC2A2AD7C73245DF4FCCD9679CEC0A7AB443E1EF962A0A95DA55291B5B86922754AD7359BEE3A9F3B40247E964814E424B2818C7A55AC2B8A29E2498094B69D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................`.......@....@....................................(.......4............,...;...P...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc...4...........................@..@.reloc..|....P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60403
                                                                                                                                                                                                                          Entropy (8bit):5.392847591907253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:vAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAA:JM4A6UAHRHF4aImg
                                                                                                                                                                                                                          MD5:504461531300EFD4F029C41A83F8DF1D
                                                                                                                                                                                                                          SHA1:2466E76730121D154C913F76941B7F42EE73C7AE
                                                                                                                                                                                                                          SHA-256:4649EEDC3BAFD98C562D4D1710F44DE19E8E93E3638BC1566E1DA63D90CB04AD
                                                                                                                                                                                                                          SHA-512:F7DD16173120DBFE2DABEAB0C171D7D5868FD3107F13C2967183582FD23FD96C7EECA8107463A4084AD9F8560CD6447C35DC18B331FD3F748521518AC8E46632
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<.......................................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):26176
                                                                                                                                                                                                                          Entropy (8bit):6.5471386409235235
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7J85B2CF1R0gU55i1SI76eR3KJ1MWVDDGPhCjov05MQ3Sn:t8hygO5i15b9KvMWVDDGson
                                                                                                                                                                                                                          MD5:D6DBCC7D45D3C02BB0048F66E66A471D
                                                                                                                                                                                                                          SHA1:0728EB1B3B12B2FA390486D69796D6ACA9C1CA62
                                                                                                                                                                                                                          SHA-256:7ECA7A4B155A53D7BE7518F2902913558CDF9135F6BA0E34AB61361220171E30
                                                                                                                                                                                                                          SHA-512:8745801D34BE115EE63F9872FFF73C8376B160C0B4EE872F9AE0FE1FB0C3A2ADA46C72ED89E3E53FAF44063614694DCFEED0E52B166DDE108CD08145810141FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........*...............................................P.......g....@.......................................... ...&...............7...........................................................................................rdata..y...........................@..@.rsrc....&... ...(..................@..@............. ._........]...........RSDS}.s....J..4..1.X....C:\vmagent_new\bin\joblist\503376\out\Release\hi\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49784
                                                                                                                                                                                                                          Entropy (8bit):6.389838075189253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:1y2lF/WFLLpAEl6Zh7laV5tp01NtY+6JWIdvDBXm1M1:M2kLlARh7ZiJWIdvDBXmq
                                                                                                                                                                                                                          MD5:A1C688B58D67842B862CF529EF91BDC0
                                                                                                                                                                                                                          SHA1:60E3E6304B99AEC159C403FDCB94A99BD6C2D696
                                                                                                                                                                                                                          SHA-256:282A547F1BB65FBFA3E09512E9646D959DC7FFA9089EBA3B0AA75866A41BD4C3
                                                                                                                                                                                                                          SHA-512:DAA64D0D89CBFF10339D103DEF289FAB585FB7E832BEB105780AF03EA8744CACC00042FA6DE334FC43E7A62CE725F5B9B83423A1A7D06B8200A5B5977F425CF9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...[.U...........!.....d...B......B...............................................+.....@....................................(.......l........................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...l...........................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48248
                                                                                                                                                                                                                          Entropy (8bit):6.0873863837523565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:eXHGdBPASgYoH6dzSnq5TmtzG3TpMta2VEJ8lAoXrtY37M0:PASgRcSqNmtzG39MkEzAqrtW7M0
                                                                                                                                                                                                                          MD5:00445BA8DC87DFA39E82978185603846
                                                                                                                                                                                                                          SHA1:CCB3FCFE5D0227CC401A0BD6A8F3CCCACB662BFA
                                                                                                                                                                                                                          SHA-256:80C17D074F0C01AEC6FC14BE7D7EAFF718D0C38D1425E956CB89BAE4F3A5F34E
                                                                                                                                                                                                                          SHA-512:173E048D0B459E5D53BAA89FA164A779192D884A92CF14638602A0E890E9B900805B7CBDD5DF16A6F0F49B804836E3406689149FECF284E27A1E6EA365153F68
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...P.U.........." .....Z...F............................................................@.................................................`...(.......t...........................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...t...........................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20448
                                                                                                                                                                                                                          Entropy (8bit):6.644890857232139
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7y3S+C8XoYR6ki2cP0iwfLseS+ShjmM6IGBkSP3:YSGXoz2cPfw9S+ST6nkA
                                                                                                                                                                                                                          MD5:24C97884C3B3C03218CF2E00A1B843F2
                                                                                                                                                                                                                          SHA1:B47F5D6744EE3F4FF419E7AC2EEB1C248FDF913A
                                                                                                                                                                                                                          SHA-256:EA25D22C9A3CBA58510FCF54C4F59FCD914323C6D01F8CB52355916D53157E50
                                                                                                                                                                                                                          SHA-512:C55C0D5CA6A42FD7CD8BD8A57429B20616BA12E937DAAD45347BDB728F9F13204F5FB1CE4FA14041ACCD76570C933B4FDCE166763FD8D0574919D2928A316B99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!........."...............................................@............@.......................................... ...............&..H)...........................................................................................rdata..r...........................@..@.rsrc........ ... ..................@..@.............#pf........V...........RSDS...3...I."..3.......C:\vmagent_new\bin\joblist\815456\out\Release\hi\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19424
                                                                                                                                                                                                                          Entropy (8bit):6.752094404658731
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:76UN5S+9l8jfWasS6ki2cP0iwfLjMlIS+ShjmM6IGBkSv:FN5FEjffS2cPfw0lIS+ST6nko
                                                                                                                                                                                                                          MD5:9FCDC96188459C100B9C4AE82F029199
                                                                                                                                                                                                                          SHA1:2E8E9840FBC143ED1350D97AA94F0C4952A67092
                                                                                                                                                                                                                          SHA-256:753DAF046E26AA4BDD7B25C8F9676283003AC25E241182AE1E45E7E9182BD7B6
                                                                                                                                                                                                                          SHA-512:CAA9EFEEFFEDA387E37F826F53091B2D82DCDF5262FBEDA9CA3E23A48B0D36BA7C7DF7BF33F1A8E04A3BF7184BB9A4131DF98A7294C7FE9252FA7E550F921652
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@...........@.......................................... ..............."..H)...........................................................................................rdata..u...........................@..@.rsrc........ ......................@..@.............#pf........Y...........RSDS......vM.s...R......C:\vmagent_new\bin\joblist\815457\out\Release\hi\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.968514351588424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:5vHP8qNfXOKM5VHblx1qhvmVqC7exscB3neUvESwTPprqWPQTUDnwENL1c:hHP8KX5M5VHRivmsCescReUsZPqid8
                                                                                                                                                                                                                          MD5:BD29091BA65B3FC08C79654997B4C82B
                                                                                                                                                                                                                          SHA1:3B353EC41DCC96D898715F6474656F13931C1B61
                                                                                                                                                                                                                          SHA-256:A3CFC3C8F95F0ED56306D28AC87408F10875C43BCA7778C6E1CC18C7A3441183
                                                                                                                                                                                                                          SHA-512:AE64DAE0E4025968BFB14E57C2FAAB0C9DA39943DAE9C884CBBD940433B29613C090B98899DB847C94B265F969A6ED3CFEBFF35AF284CA9619E6E25937067650
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................A..a,.@.-_...#.....2..vI...^..2..H"..........yU.;.i[..{.~:p.u.!...&..JnZ.......)px...@-T......7.HK.)...Z...[@n,4..h.C.!....#..w%..w.`...0..$................0...............q.%H...CK.d.d.=\I...).../..UQ.9z..@.(..gc3v.... ..v..+......`f.~.z........o+..}..az............(-z......3.*..7>T8O...._='..P.hX.....Itvz...r~$.....r.3....L.e..H|. z>x!;C..J..a.=..c$.....6..6..._s~..b"-...!.fI.&....w.]b......+....b...U./..m.6[.o.DS...=>..._C8.Av..yy.^*Sh-.s..Z......w\.n.;...q..h..Q.....<..V.........t.....4.6..F..=Q*..........0B..h.ja..=......|..>dz.,.)......&.......3..|..;]"q..A......R.y{.......$.d.L.:.......]j...G./<mFJ.!.,Lc.....Fcvw..{4.SH.*..m..l..|.?`N=d.l....O..y~....u9..?s....Jy..P

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32908
                                                                                                                                                                                                                          Entropy (8bit):7.98579519717503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:mqPy0zBxmlBLCxBIZuPVOWdT0bQUu9d2+8Pc1fCrGrP:m90nmlBLSBjt/T0MUu2ofCrY
                                                                                                                                                                                                                          MD5:F507C8DB8F8EC9361F36608408C9939E
                                                                                                                                                                                                                          SHA1:F3915EDB67FC281DDE5657B383E3A5AEDFE96BB8
                                                                                                                                                                                                                          SHA-256:DAB50E3C2787808BEEB0B377AD7C3DE2C518578B9F7A4EC4AC29063D59C00B3D
                                                                                                                                                                                                                          SHA-512:CB09E4F033B873211BFA8B8B82FA207EA5C176D8D686487C2253214F5F965734D2A16A04AE41B849FFA20B3B03814714274B749F07DBC28A0A5676A86630FEEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................r.e.g.m.o.n...d.a.t..............................................................................................................`1.!.../.C~.}.Q.i.{,..L......B.PG...xJ..L#.......B#.5J?.j}..f..`x.F.dG.p......."...VOn%.%M.D.;.F;.XL].o.S.DK....F[.....]....#..w%..w.`...0..d.6..............0..........X.6./).5.b..V..p,...u}".~..t...0...r..6,...c.....y..>.....lxh.t...O...-}~.c..1.'zv:..s..t^.|....%.."k.c....n.....J..x&. ._.-...\.9>.$.q.).~........v...b..IY.{...cp.f5..F.&..o.].V....0..J....w..f].%...!..\t.s+.J}....7.X..nI.z.M0...5...)x.8\G.._..w@.'..1....?=D.y.:Hw...9.@.Y.9.hd...$h^..I.G..gy..j.......5...nB.4 0!e..N...WQ.k....:x.9.`........3....38...W[..K1..{Q`..5P&z..8.J<.`.'+.i.y..0.a"Zu......KS......M..h...O..qbj..$../Z.M&...;...`..n.>..#.8. .m...|...s.$.K.T*c.....H.Z.S...P..5..#....^[.a=...........V.k..)r..%.i_.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):6.994168084927728
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7m9oJfglpLoZ6ki2cP0iwfL4/S+ShjmM6IGBkS8R:soJYlpLo82cPfwES+ST6nk3
                                                                                                                                                                                                                          MD5:174F9D6C710C6D2EA8A3BF2CEEE7E13A
                                                                                                                                                                                                                          SHA1:847F01C85C68AA5D0A80086BD718DD0B71D59E6D
                                                                                                                                                                                                                          SHA-256:D3AE82B8B837802316FEC275CBA0F5872085AB5E178297DECC3607FC1EBE0250
                                                                                                                                                                                                                          SHA-512:8285355F7A2E902526116BA066F91FEC5EEC480BBA57054B6F1AF5421465760BB286233210BB4DC48F55F274F475559C6BE5B9735FA3302E73BDFFB07B3616CD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...bfrf...........!.........................................................@.......K....@.......................................... ..................H)...........................................................................................rdata..t...........................@..@.rsrc........ ......................@..@............bfrf........X...........RSDS..b...B...6W3"J....C:\vmagent_new\bin\joblist\815994\out\Release\hi\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1066, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091584
                                                                                                                                                                                                                          Entropy (8bit):6.847260943214952
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:fMManNeMT9EHX23PMgMz+0+wIGqB8B3pEp/g+h38:WNFwX235Mz+fwI3CF
                                                                                                                                                                                                                          MD5:56012F8992D44C15C3368A4CE6CEA123
                                                                                                                                                                                                                          SHA1:F100856ACCAB079BEB5275C9596AA47579D8FB83
                                                                                                                                                                                                                          SHA-256:2DA2ABF3F9DD74429ACF0C93F05DE7858112A681255267C9E07313439CB17BA2
                                                                                                                                                                                                                          SHA-512:2EB17BCC6A930B78F69026324925CEAD5B7F2989D9A3A0FF68602F8E722BD7E881EA0BB26947E2835054F88FFB9814D2F07A94F120BC9E2A4C59C07FA0489B77
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......*.................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007009, page size 1024, file counter 291, database pages 793, cookie 0xa, schema 1, UTF-8, version-valid-for 291
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):812032
                                                                                                                                                                                                                          Entropy (8bit):5.831830176063422
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:Ijt5CQRUdpa9hnysVBhXRn1yZBjHYgCuosZUoQH2uO:SCQRUdI9hnysVrN8BTYgCuxUoP
                                                                                                                                                                                                                          MD5:855DDEB2E0E0EF82645844CB169AD93D
                                                                                                                                                                                                                          SHA1:2C010003323E598BEA6206DD99477E4897BD4AD9
                                                                                                                                                                                                                          SHA-256:5153C8B3CAC03951852DDEF293E4854A636B6A8EFFFC747D758B07D60C01327A
                                                                                                                                                                                                                          SHA-512:51A06B2B94DB5A8FD7638C1908497A3A03EE17096CE595A41095F4AA6AD9B95019DE821AEF46059A6A66DA706CC428C0D00BE1A6516A5DA8C359704B742368DF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ ...#...................................................................#.-.!.................[.....W............................tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main.....>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).).........{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):31864
                                                                                                                                                                                                                          Entropy (8bit):6.102981707135661
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7KHyacsultAgwBAP3Excizfbdx/MCLz7eMXXB:e6t4B23ESYfZx0+
                                                                                                                                                                                                                          MD5:44D6531AA7031C983D8DE709D8319BDE
                                                                                                                                                                                                                          SHA1:A212B655CDAA5CF7567D43F2D5490F866ABBED0F
                                                                                                                                                                                                                          SHA-256:852217DCEEEAD59BE207B207AB56D8D7072B3738A017F8F14C7FFCFCDADC5569
                                                                                                                                                                                                                          SHA-512:6C3E0757410F0691AA4369CAD0E0DE70E4DC161F1D006DA802AAE6461E99CDAAA8DAD037066466A6A82E4E9007CB11C938585CDE44700C99618609380661BC51
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...N..T...........!.........b......................................................M.....@.......................................... ..|_...........f...............................................................................................rdata..............................@..@.rsrc...|_... ...`..................@..@............N..T........v...........RSDS..B...@....5.4....D:\Projects\SafeGuardIntl\branches\SafeInt_V6.2\i18n\I18N\SPTOOL\HI\Release\360SPTool.exe.pdb.......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2260
                                                                                                                                                                                                                          Entropy (8bit):4.20226792336563
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uNuM/+/z+W77RsDbcvX955+Wh/nnla+WK7nnlosuX+/K3+WMK64f3:r3NxSNqcvXh/nlJLnlokM3
                                                                                                                                                                                                                          MD5:3D1B94CE05B95071695E734B3D3247EA
                                                                                                                                                                                                                          SHA1:BF6A3778B418EDB5F4D3B7062837933044E93F0D
                                                                                                                                                                                                                          SHA-256:47E83B1ACC3231F757F16E098B930450A4DB6589BD557920E5A72AF0C8AC09B0
                                                                                                                                                                                                                          SHA-512:A49E053FA471445E7D9115E76C3FC020771A6AA01E312DF490BD3C72D7E7A984E0E1651AC6CABB6D3E711483C1EB4B9AFEAE2EA36E76636443C8D52CE2AEDBBF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=..... ...>.0.M./...M.0... ...*.(.G. .5.G.,. ...H...0.>. .$... .*.9.A.....(.G.....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=..... .8...&.G.9...(... .*.M.0.K...M.0.>... ...*...G. .5.G.,...H... .*.0. .*.9.A..... .*.M.0.>.*.M.$. ...0. .0.9.>. .9.H.....I.D.S._.T.I.T.L.E._.R.E.D.=...*...G. .5.G.,...H... .*.0. .*.9.A..... .*.M.0.>.*.M.$. ...0.(.G. .5.>.2.G. .T.r.o.j.a.n. ...>. .*.$.>. ...2.>.....I.D.S._.N.O.T.E._.B.L.U.E.=./.&.?. ...*.(.G. ...*.(.G. .5.G.,...H... ...G. .*.9.A..... ...K. .*.M.0.>.0...-. .(.9.@... ...?./.>. .9.H.,. .$.K. ...8.G. ...5.0.A.&.M.'. ...0.(.G. ...@. ...(.A.6...8.>. ...@. ...>.$.@. .9.H.......I.D.S._.N.O.T.E._.O.R.A.N.G.E.=...*...G. .5.G.,...H... .*.0. .*.9.A..... .*.M.0.>.*.M.$. ...0.(.G. .5.>.2.G. .8...&.G.9...(... .*.M.0.K...M.0.>... ...>. .*.$.>. ...2.>. .9.H. ...0. ...8.G. .0.K... .&.?./.>. .../.>. .9.H.......I.D.S._.N.O.T.E._.R.E.D.=...*...G. .5.G.,...H... .*.0. .*.9.A..... .*.M.0.>.*.M.$. ...0.(.G. .5.>.2.G. .T.r.o.j.a.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):109056
                                                                                                                                                                                                                          Entropy (8bit):5.418736436329343
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:6ORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3b:6OBrUC4jyUJGKzgSg+H9XnF1G
                                                                                                                                                                                                                          MD5:EE38515F243FFC1F3D6101AC6F15FD30
                                                                                                                                                                                                                          SHA1:826A4F2D558BC1B6245307D68CD64FEBC7765AE4
                                                                                                                                                                                                                          SHA-256:297589AD8168809E5A70DDF20F1BCECC0F998C93A84E7C14F77EC76A38F630BF
                                                                                                                                                                                                                          SHA-512:0C8C5E5F0D31F1697170B70DFA319CF347A2EFEF1D6FBAA52F40CCB46EF5CC0FA99D0660E42991C2E51E7A559273AA0B96478497C72FF29DD72B1576EFFF6E3B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........n......................................................f_....@.......................................... ...k...........r..h7...........................................................................................rdata..............................@..@.rsrc....k... ...l..................@..@..............2\........w...........RSDS_.?d..MH...O=t......E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\hi\Release\360procmon.dll.pdb......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):53880
                                                                                                                                                                                                                          Entropy (8bit):6.016807496488604
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:g3v+tnPKY4PWWYzpnD9UT1tFGHXjpjqrVN/rfroLomxnYdA1T6pj2z:LKJSpD9+1tFGHXt+R9rGjO52z
                                                                                                                                                                                                                          MD5:F53E13F3DFB04D945AE5985FC99C1BB0
                                                                                                                                                                                                                          SHA1:F755FC6C800657746602483EC2C2828FCFDE3914
                                                                                                                                                                                                                          SHA-256:5B512644E63817D06E2E6DFC210195A9F9A4388B8902111E992B5C773C121849
                                                                                                                                                                                                                          SHA-512:793F83F0FEE6A87D67F0570AA470458CED585E2E33A38DD3F100F52E882683F7AD7375F29B772C2A179FAE12CBCB74518E7821BAECFFFA85F2ADD52CB7E3410D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...z.U.........." .....Z...\.......................................................[....@.....................................................(...................................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22528
                                                                                                                                                                                                                          Entropy (8bit):6.82494137985784
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:77YXJ+FUI70HVJeMyOHlbQC5QKvrfpMQ3wC:gXJ+FrQ11FbQC5Qw+C
                                                                                                                                                                                                                          MD5:7E7FDE4FCCA97619F736CCD6DF721175
                                                                                                                                                                                                                          SHA1:E9C30AA8481E5709075351252B360D7587A76F44
                                                                                                                                                                                                                          SHA-256:90C1031AC9B5F82F9FDA4ED21309E1708A45CE1AE816E8ECDB42424BF3B31F0A
                                                                                                                                                                                                                          SHA-512:D6E0C99422C8332DE1D3C486BF174D4A7575CB3023E30EBAA69A0D46057B2ADAA1C5F8F005EE81C2DF74BCB5C3BDA2A2E151A141AC9892DEEECE1D5DB8D41E52
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....3\...........!.........................................................0......@.....@.......................................................... ..h7...........................................................................................rsrc...............................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...........................................9.......................9.......................9.......................9.......................9.......................9...............................................9...........................(...8................................!..............."..D...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.134123402849046
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7sLB604ZWeI7nOSeMwmQj4A8nQJ+MQ3KYa:MB604ZwI4AnJ1t
                                                                                                                                                                                                                          MD5:3FAA90F4248BD9EF47D51BAB11729E84
                                                                                                                                                                                                                          SHA1:6A0405AAA9371046FCF8BDBCA45F0A3029429A1E
                                                                                                                                                                                                                          SHA-256:9784920FBE60C2E767FA82879A0E6DBFD67384D70DDCEA9DC5D628F8045F653F
                                                                                                                                                                                                                          SHA-512:19A80B4B4359A7E3463042A6DC994C2A6E614743EF9F5657960DF8DC72D7FB6FB051A1D417F1B9C3B70D25E6FD841938104F3D33ABD14773195AF11393A9F17C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0............@.......................................... ..t................7...........................................................................................rdata..}...........................@..@.rsrc...t.... ......................@..@...............[........a...........RSDS.....)N.v.nKR.)....C:\vmagent_new\bin\joblist\259671\out\Release\hi\UDiskScanEngine.dll.pdb............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19512
                                                                                                                                                                                                                          Entropy (8bit):6.998501138950307
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:75JtBeR3K+h1MeK6jtNPUSDGPhClov05MQ3:FJts9K0MeKgfUSDGao
                                                                                                                                                                                                                          MD5:548427395473234A306C29AE897D617A
                                                                                                                                                                                                                          SHA1:A7F0252A9375B150C07C1F21D77918C099882C9F
                                                                                                                                                                                                                          SHA-256:60590C27A7B6A8158F5439D1EC4EBEB830A4E5B7D61E4B66436E18278B32F014
                                                                                                                                                                                                                          SHA-512:C518718EFB7705770F4CABEB516778F42DAA2DC453725F59410EBFE720BBC982DF182C498470F8F4FB74DDE08C354AA3DA666BDB282BEC33940D72141B469838
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... ....../G....@..............................................................;...........................................................................................rsrc...............................@..@....................................................................8.......P.......x...................................................................................................`... .......................8.......................P...................9...h...................9...x...................9.......................9...............................................9...................................,...............8...........T...............h...............d...................................Z.............I.D.D._.D.L.G.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54904
                                                                                                                                                                                                                          Entropy (8bit):6.333419872341105
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:YCG11xWF7Lp/El6Eh7lKlJ01Q+6JW1xnYdA3acBAylh:lGa7l/8h7xCJW3EcBA0h
                                                                                                                                                                                                                          MD5:8CAEE7CE780DCC341997A55378120104
                                                                                                                                                                                                                          SHA1:60B1DBABC68DA3DD25B4242D438E14283146C284
                                                                                                                                                                                                                          SHA-256:979E461F06305928A6529768292826E7D2F01D373C9C379A73C6EAD728E4C21E
                                                                                                                                                                                                                          SHA-512:EE729EBEC7BC16E1EBC52A5C67AA3712B203DC62073803AEB11095F5E97934DF3FE995F764F62A9EDEA8ED7A5F7609D9B714B949A560370B018DA0F1D20AB869
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...8.U...........!.....d...V......B...............................................y.....@.....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc...............................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.827352027991024
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7PRMIDyMrj1grjzR+vnr9ZCspE+TMArmreZGQC5y:7PRxGM8z7eMvrC3C5y
                                                                                                                                                                                                                          MD5:2A7A7F903179394302CF47E52FCB997A
                                                                                                                                                                                                                          SHA1:EC5972A8F6AC68C1765A038538F5E3700B584835
                                                                                                                                                                                                                          SHA-256:D17477FAA46BA23CD8CC4ED28F175D4327A1CEABB666756B50B6A912545D48A9
                                                                                                                                                                                                                          SHA-512:541D523C48462AFF4E0C2ABAAEC1C565473268D8B9A1B708015C679376246FBBAB8B2869E51594A2E2550CB12D201CD19A0786C93D25490760B69417CDE1EF76
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ............@.............................................L............................................................................................................rsrc...L...........................@..@....................................................................0.......P.......h...........................................................`.......................................................................9.......................9... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .,.M.0.>.....<.0...M.i.c.r.o.s.o.f.t. .E.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.74794304119921
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7jM63yMrj1grjzR+vnr9ZCspE+TMArXEQJS:7jzCM8z7eMaJS
                                                                                                                                                                                                                          MD5:51D27C65621516084AE5C62463FC70B2
                                                                                                                                                                                                                          SHA1:DF6240ACD69D619C0DE1AC37414CE361F859CB65
                                                                                                                                                                                                                          SHA-256:41872E27B7A36989868C15F33A542F97E1CB27E1AF35F77472D003DC5925E4ED
                                                                                                                                                                                                                          SHA-512:A51A4F7DEDE8C0EA06A6511BA5F660D17B96A201ECC3DB7CE6DDBEFC068F6DB9D129D83BDF7ED6C029C24A2876A817A9665391E72FAE729E977BEE9DFFABC8A1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... ......W.....@.............................................................L............................................................................................................rsrc...L...........................@..@....................................................0.......P.......h...........................................................`.......................................................................9.......................9... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .,.M.0.>.....<.0...M.i.c.r.o.s.o.f.t. .E.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):550
                                                                                                                                                                                                                          Entropy (8bit):4.270600263027184
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Q++ubxBq710GQufEWkmhR4Cq7EgEFqs2YHE9z7X3E988uEUEs2Y7f:Q++uzKnLzXKE5qs2YeG88ugs2Y7f
                                                                                                                                                                                                                          MD5:A6FC63102781E90D66388E893E2874EF
                                                                                                                                                                                                                          SHA1:50405BF52AC67F5FE13D086EF4B8BBD401BBE6E4
                                                                                                                                                                                                                          SHA-256:208CED4364E9D841B26B2A6D11B5B9EC968895D7D54D008223162FC7C79DBA38
                                                                                                                                                                                                                          SHA-512:1E8B8EA3B77CC0B3471E1729F93FA8BA723AC2B762621B627AD7BDAFC80D74B48ED6DBBAA4ECE19594B820E755639B1E5C4E4F633E6F201F45A09D32E02172E0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=.8.>.+.<. ...?./.>. .../.>.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.U.-.d.i.s.k. ...@. .8...&.G.9.>.8.M.*.&. .+.<.>...2.G.......I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=.8.>.+.<. ...?./.>. .../.>.:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=.*.A.(.0.M.*.M.0.>.*.M.$. ...0.G.......I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.U.S.B. .!.M.0.>...5. ...G. ...A.*.G. .9.A... .+.<.K.2.M.!.0.....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=...8. .0.B.*. ...G... .*.A.(.0.M.*.M.0.>.*.M.$. ...?./.>. .../.>.:.\.n.%.s.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8530
                                                                                                                                                                                                                          Entropy (8bit):3.6353156920731435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVlTeNqWIajOwapG4Y8nW6WSbJ1J9W36CFWbmc:29+DgRgiz8G4Y8nzWXFWT
                                                                                                                                                                                                                          MD5:DB2D93B8192594964A8E291FD87A62CA
                                                                                                                                                                                                                          SHA1:C412EF634F0DAE0C953D969DAFFDCF06EE9C2485
                                                                                                                                                                                                                          SHA-256:75A8014BC75E3D26C84A2060F8A9D6F7CA7B9C7B8E5D5ECB548999F56605A1BF
                                                                                                                                                                                                                          SHA-512:1C8ECD57CF2D65C402ECCEDBFEE4C83512305F07CAAA75D11AE0E33B45DC5C544DCCF21B49582B3A0350E23E40812E02654804EDF219B971F44D1542ACD5AD2E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.337717214377934
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsgg6PCabR:r5u5/+mMks5qTp1mNqce9Oof6aabR
                                                                                                                                                                                                                          MD5:37EE17A2196510E7174BF1603BD82A2D
                                                                                                                                                                                                                          SHA1:017AE4073A164E23E3195275DCCA5D8C8064397F
                                                                                                                                                                                                                          SHA-256:BB0D11A1FC1911A8289258324B0D21E32FA8189D3978540A4324376B52ACA7AB
                                                                                                                                                                                                                          SHA-512:A21C3DA1947C8DC4EC87397E5102EA9E2FABF0044F8AF71452A206934485E0A1D98D5A5BF20E67DF73E0970CC04FA1D5DB5A5DB0609D8C38B608087B06CAE5B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\hi\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.742649679488968
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7YCW0v7asmI/yMrj6rrjzR+vnr9ZCspE+TMorL3nx:7bTmJMCLz7eME3nx
                                                                                                                                                                                                                          MD5:3617D3C0A4511AC8108050D7BBF0341C
                                                                                                                                                                                                                          SHA1:04B44BCECE9EF1C25A83F3693FAE3A73DDABE4AF
                                                                                                                                                                                                                          SHA-256:81D1A559583BA63ED31006FF7D2757394524EC997924897069CF94093FDC1497
                                                                                                                                                                                                                          SHA-512:B472164AD008C31BDFEE4DA9CC66DB0CB2C3E91B3C0384E88DE775C6631D987651E658BCB16D740AEA371B796219BC5CA256D9F59F4C989BB9AA3EC7DE95B807
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......T...........!......................................................... ...........@.............................................$............................................................................................................rsrc...$...........................@..@....................................................................(.......P.......h...........................................................................................................9.......................9.......................9...........................(.......................8...H...8...........................................P...x...............Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.f.o.x.?.,.@... ...G... .0.K...>. .../.>. .%.s.,. .%.s. .[.H.a.r.m.f.u.l.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):129088
                                                                                                                                                                                                                          Entropy (8bit):5.235285859357208
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:FmvblAch7jyRouOK5v33b3vjXbtKvgVOgwzBPOxeF5u:FMyRo6agVOgwQxW5u
                                                                                                                                                                                                                          MD5:3F20D1EACD506CA0A0E8B7E40D3080FD
                                                                                                                                                                                                                          SHA1:EB75FC7EA50E6F24CD9941FD7526FB6B72DBD86F
                                                                                                                                                                                                                          SHA-256:9F7A13268092B7C5BAB83CCD78E8DBB2568C24600371AFF9FAE8D8B30DC15241
                                                                                                                                                                                                                          SHA-512:C53F4FA335AEA376A4DE69D9BFA1EB3B325A09DDBE3557718B5624DFC3A8EE044D11AF5BAF24EECDDF70E5F30BF5AA9652A458854431615E6C188E26B205F00A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L...c..[...........!.....d...V......B.....................................................@....................................(.......|................7.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc...|...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with very long lines (320), with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1826
                                                                                                                                                                                                                          Entropy (8bit):3.5580540386379407
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uL22QVgqeMD7div/xGJE9G+lus4SsJY733qbO8lJeViee:r3LHQVgqezxG29GDDSsJY7nqb/Ue
                                                                                                                                                                                                                          MD5:BBDCEB3C02AA63D8BB625D99CD6328A2
                                                                                                                                                                                                                          SHA1:60FF055ADDA01E20043C65E2A4FD9E5A6CF5EBD9
                                                                                                                                                                                                                          SHA-256:73900D5889945807FCB28E4462E817C9E71171A37C0F2871CF91718AF955C7D5
                                                                                                                                                                                                                          SHA-512:C2BADF1921A2DB534E3386940EC935C85408063A2C80170C2658F37C174480C59B9BE5B1D407F9FFF06F348858592BB94FAB6B4941B63676BB34B382CD773D0E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.S.e.g.n.a.l.a.z.i.o.n.e. .d.i. .e.r.r.o.r.e. .3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y.....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=.h.a. .r.i.s.c.o.n.t.r.a.t.o. .u.n. .p.r.o.b.l.e.m.a. .g.r.a.v.e.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=.C.i. .s.c.u.s.i.a.m.o. .p.e.r. .l.'.i.n.c.o.n.v.e.n.i.e.n.t.e.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=... .s.t.a.t.o. .r.i.l.e.v.a.t.o. .u.n. .e.r.r.o.r.e. .n.e.l. .p.r.o.g.r.a.m.m.a. .i.n. .u.s.o. .e.d. ... .n.e.c.e.s.s.a.r.i.o. .c.h.i.u.d.e.r.l.o... .I.n.v.i.a. .q.u.e.s.t.e. .i.n.f.o.r.m.a.z.i.o.n.i. .a.l. .n.o.s.t.r.o. .s.i.t.o. .W.e.b. .p.e.r. .a.i.u.t.a.r.c.i. .a. .m.i.g.l.i.o.r.a.r.e. .l.a. .q.u.a.l.i.t... .d.e.i. .n.o.s.t.r.i. .p.r.o.d.o.t.t.i... .L.e. .i.n.f.o.r.m.a.z.i.o.n.i. .v.e.r.r.a.n.n.o. .i.n.v.i.a.t.e. .s.o.l.t.a.n.t.o. .a.l.l.'.i.n.t.e.r.n.o. .d.e.l.l.a. .m.e.m.o.r.i.a. .e. .n.o.n. .

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\LibSDI.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):117084
                                                                                                                                                                                                                          Entropy (8bit):7.998576290058294
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:9XDg0lkkKj6KcrrssAnxLxRxL6RXyuIWm9byiaFz3:B5LVr4s8LxHL6RXXh
                                                                                                                                                                                                                          MD5:7E51C48007D288C12B6671FD7F9E0409
                                                                                                                                                                                                                          SHA1:0EFF6E04409125BE3EB42C1CA0351A3BD0E62BC2
                                                                                                                                                                                                                          SHA-256:85A96EAD2A6BD2ADB42465742EE352A594CAB05E2AE17088DA9C55999BBEA4EA
                                                                                                                                                                                                                          SHA-512:DB21E27AEE466D7209858E734713229F1FDDB36AA9D9E63E6A68EC38005883299C7ED199845065909CAFF6F98DEFCB51036A399B2A10DA431C02BB7FF94243BC
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:h=.[;.....l9V.x.!..~.F...7Qp.p.=.8A`'`.|...,........X.....,.%.....9..f-.<t....n..ws.....2.K..LFJ6...wS...-.%.(........}....d t..y..;.kw.......R......L"...4.h...4..F..;.A...}T....q.M.Et.2o&.SPP..O..:.0.........].....w..Ft.A...~.M(, ...`.U'......e...H...W......C...)... %..mq.D.@...sL\;Gi6..%-?...pA.,@..D.'..U..=Aj.....OS....v.".n}......8.8...z......=j.-.?..>..v`Ds..B.[p.j...eW7[p..M.{.q..3.!..u.A....[n..z..|...o..Ud...A......uEFZ.o...-...?...L.q.FA}...x......\.V.F..zq.......=^..3.*.t.C....~S...A#...E.........4..Y9S).S:.$.q.Fz.d..(.D..r..?........6.vE#Ps...p......>..z........M...=EN...NI{...U.....>V]......aY(u....,....~..V....C..(Je.y.J......T..8t...@N...`L..1>.>m[.z/..z..6]......f..v...5.T.U.....'....D..1T....4.......(.K...D.K. Ux.I..DP...!0+......}-q..}GZ.K..*.P....J..g.=w......w;.......`...I.q......e.....Pi.e.8n..6: .i....!u.L..'..&._...?...]Q..f...qI7b........oZ....d.;.b`..l.<g.......A...9k.....&u^...}O..J3P....@.tH5...{.....^.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.599785199833065
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7dKtGrtIG1jI7nOSeMUU7j2xoz2DDMQ3Kv:pKtaIG184UPwozkmv
                                                                                                                                                                                                                          MD5:4664DA91938A093A33C849A4B8D49274
                                                                                                                                                                                                                          SHA1:F72162C20F52174F9E2D268C00DBCDD12B577259
                                                                                                                                                                                                                          SHA-256:B39DA6D939EC2A07A34A2693584F3BF3962F10D9CAB444703B281D981924BFC5
                                                                                                                                                                                                                          SHA-512:D1EF0DD7F7E657C73E32522A9DBAE0F59AE51C6D66D0227552B0A93FD7DE74F4B2ACE8C9C06C04D9A01AB9D3D9D86CB8BCDAE08F6B7EE9F48E06580AE2B6CCC9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....s.[...........!.........................................................@......1k....@.......................................... ..L............ ...7...........................................................................................rdata..y...........................@..@.rsrc...L.... ......................@..@.............s.[........]...........RSDS.J$a...D..T.."5.....C:\vmagent_new\bin\joblist\259029\out\Release\it\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75832
                                                                                                                                                                                                                          Entropy (8bit):4.777986582917558
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:KfdNl5qN9j/wWfZb/XFeoy5yFYECG5fgATSQPA3MQzQMuv9K0MeKgwDGxQwpB:KF35mbwYhJX20Mk9weD3
                                                                                                                                                                                                                          MD5:EE233F12C989D289C955237B62CDF888
                                                                                                                                                                                                                          SHA1:DC3E63C13E0FD8A2A2D13688B57F78F6A94158EA
                                                                                                                                                                                                                          SHA-256:CF41F5B50D67B67E8ADF54AC39C372D15716E371E1CF38D016B4E86BFAB8162A
                                                                                                                                                                                                                          SHA-512:602FA778A64A5C49320641B4C2D2BDDE23E322430366D6D746E241CE5D0ACE2302B84AF479AECA0FB64BF23D115D6F8CAA987EA231C774539320FCB71ECCD68E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..x...x...x.......x.......x.......x.......x.......x...y...x.......x.......x.......x.Rich..x.........PE..L......^...........!......................... ...............................0............@..................................!..<....@...................;... .. .... ............................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67688
                                                                                                                                                                                                                          Entropy (8bit):4.746474657591871
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:2E4ul5xBj/wWfZb/XFeoy5yFYECG51gATSQPA3MQIGduv+Pocc3Q73whrm:tBbwYh3X27dI+wJQ7gha
                                                                                                                                                                                                                          MD5:B101AFDB6A10A8408347207A95EA827A
                                                                                                                                                                                                                          SHA1:BF9CDB457E2C3E6604C35BD93C6D819AC8034D55
                                                                                                                                                                                                                          SHA-256:41FC1D658E3D6795B701495D45E8D7BEF7D8CE770138044B34FBACAD08A617BE
                                                                                                                                                                                                                          SHA-512:CE24418045352557B5D0ED9EC71DB00D016938CD0FC2308E3BA0A61CD40EC0DF3A9B620E55D28724B509BAB3F801B7A88548B0B08B7D868A6046F85A49AAE910
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....)Z...........!.................................................................^....@.............................................T................5...........................................................................................rsrc...T...........................@..@....................................................................0.......8.......X.......p...................~.......x........................................... .......8.......P.......h...............................................................(.......@.......X.......p...............................................................0.......H.......`...................0...x...`.......................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54840
                                                                                                                                                                                                                          Entropy (8bit):5.180465169603834
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:IfdNeavj/wWfZb/XFeoy5yFYECG5nTUKI9K0MeKgiDGMo:IFombwYh5Ux9we
                                                                                                                                                                                                                          MD5:25193DEA059E94B64B72D5D0A18AF159
                                                                                                                                                                                                                          SHA1:AAF00C89A6BBCBE126FC9D469C0B054B89A385FC
                                                                                                                                                                                                                          SHA-256:17D8D68F752850315FF43F0077EE3E036AE35FDF8EE4CE7DEFAAAAF3036D438A
                                                                                                                                                                                                                          SHA-512:679AF78653AC2F43C69CC657512130604EE7DC492BBA3456D4CFC2CEE23043B89367DC604E82543EA2DFBC8110CDA9A8E17F7772F6B70940F5B928E8C9ACFC8A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..x...x...x.......x.......x.......x.......x.......x...y...x.......x.......x.......x.Rich..x.........PE..L......^...........!......................... .......................................E....@..................................!..<....@...................;...... .... ............................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60403
                                                                                                                                                                                                                          Entropy (8bit):5.392847591907253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:vAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAA:JM4A6UAHRHF4aImg
                                                                                                                                                                                                                          MD5:504461531300EFD4F029C41A83F8DF1D
                                                                                                                                                                                                                          SHA1:2466E76730121D154C913F76941B7F42EE73C7AE
                                                                                                                                                                                                                          SHA-256:4649EEDC3BAFD98C562D4D1710F44DE19E8E93E3638BC1566E1DA63D90CB04AD
                                                                                                                                                                                                                          SHA-512:F7DD16173120DBFE2DABEAB0C171D7D5868FD3107F13C2967183582FD23FD96C7EECA8107463A4084AD9F8560CD6447C35DC18B331FD3F748521518AC8E46632
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<.......................................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44321
                                                                                                                                                                                                                          Entropy (8bit):7.723619855150623
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:yWKsjvn5jKAqfMtWqmYcQ/ibhlwmzWk+MUKfiZw+5xpVRTtST9vlv:F5jxxtZmY5/ibhlpzWk+JVZXxvR5SFV
                                                                                                                                                                                                                          MD5:BED1CDFA1BC4CA7749AF8D4C9304ECC2
                                                                                                                                                                                                                          SHA1:3547D843FB9F5C00ED10ECCBE83BDBCE6FCCEAB9
                                                                                                                                                                                                                          SHA-256:9C55D7B72B721034A0A76986D2D08287BA4867EC9CB3FA1B8F4DE3C851EB7A8D
                                                                                                                                                                                                                          SHA-512:AD4A29F03331E0FD684533DD580FF1674AA890DDEA7F22747770FB50FFC2CFC8BC35AA867B44A355E279AD1E2F6220598781109F5D6C7CDFA587008402B00E94
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:I"...-..u063....................ay...[...[..;.?.3..@...R...*L.[...@....w.w$&.....\aJ.TR..e..i....Q~.!.v.....s0ob.._.2Y'u..0.rX.J...hU..+......h.Z$.O{.h...K.;.....%._nn.k...<..CgM.Vk..D$1....sZ...kn:.!D.z.b... ...,j..f......hL..a...f..d...ihs..z4...R.....{N.8.M....pk.E.f...y.up......<.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25152
                                                                                                                                                                                                                          Entropy (8bit):6.326201527087637
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7syVo1VK5ysI76eR3KJ1M81rDGPhCMov05MQ3d:nVAK5yTb9KvMcrDGroY
                                                                                                                                                                                                                          MD5:CD37F1DBEEF509B8B716794A8381B4F3
                                                                                                                                                                                                                          SHA1:3C343B99EC5AF396F3127D1C9D55FD5CFA099DCF
                                                                                                                                                                                                                          SHA-256:4D1A978E09C6DAFDCF8D1D315191A9FB8C0D2695E75C7B8650817D027008D1C1
                                                                                                                                                                                                                          SHA-512:178B73ED00BFD8241CC9191DBDD631AE28B5C7E76661863B326EFDE2DC2CB438716C0B70896EE313436CCD90F61DB5226A3484169176F5A4B79EAD1FB4451419
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........&...............................................P............@.......................................... ..x#...........*...7...........................................................................................rdata..y...........................@..@.rsrc...x#... ...$..................@..@............. ._........]...........RSDS2.O5m.{F..........C:\vmagent_new\bin\joblist\503376\out\Release\en\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49272
                                                                                                                                                                                                                          Entropy (8bit):6.359306772453438
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:5y2lF/WFLLpAEl6Zh7laV5tX01StY+6JWgdvmBV2M3:A2kLlARh7vPJWgdvmBV2m
                                                                                                                                                                                                                          MD5:3E88C42C6E9FA317102C1F875F73D549
                                                                                                                                                                                                                          SHA1:156820D9F3BF6B24C7D24330EB6EF73FE33C7F72
                                                                                                                                                                                                                          SHA-256:7E885136A20C3AB48CDEAD810381DCCB10761336A62908CE78FE7F7D397CDE0E
                                                                                                                                                                                                                          SHA-512:58341734FB0CF666DFE9032A52674A645306A93430EBB2C6E5AD987E66CE19C8A91F3FEEBF9BBA54B981D62127613DEC3C939EF4168054D124B855A511B6D59C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...a.U...........!.....d...@......B.....................................................@....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):47736
                                                                                                                                                                                                                          Entropy (8bit):6.053954085108329
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:VXHGdBPASgYoH6dzSnq5TmtzG3TpMtaTV2J8lAovrtd1tnQr:0ASgRcSqNmtzG39Mk5NAOrtLtna
                                                                                                                                                                                                                          MD5:DC4A1C5B62580028A908F63D712C4A99
                                                                                                                                                                                                                          SHA1:5856C971AD3FEBE92DF52DB7AADAAD1438994671
                                                                                                                                                                                                                          SHA-256:EE05002E64E561777EA43AC5B9857141DABB7C9EED007A0D57C30924F61AF91E
                                                                                                                                                                                                                          SHA-512:45DA43AC5B0321DDC5EC599818287BD87B7B6822C8DD6D790B5BBF1232000092AFA695774CD3D9C787919AD02CA9846F7200970E273A99BFBE2AA6BEBFE7E8ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...S.U.........." .....Z...D......................................................^.....@.................................................`...(...................................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20448
                                                                                                                                                                                                                          Entropy (8bit):6.434428355428392
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7dIRqwp/JNxmSRxyE5nIUb6ki2cP0iwfLBKyS+ShjmM6IGBkSEOV:e7yE5922cPfwnS+ST6nk3a
                                                                                                                                                                                                                          MD5:F584EFD5356E4A1BE69209A6A90F8DCA
                                                                                                                                                                                                                          SHA1:6AF86C8FA9C4EA0F28ECA735ACAD675CB32B7EC5
                                                                                                                                                                                                                          SHA-256:CDE2A0834CB8B6E4FABDA07F611567A392B2E4DC23F2FC7921F8B13E774DA940
                                                                                                                                                                                                                          SHA-512:97C02D900A05DBB2F5BA7CD33F53D4B5C67655D0DD11D6B1C374867570DD7CD5114DEB138DB277480FB45E608CCCF7542D76C4CCE7FB5C98356A5105B309BEBA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!........."...............................................@............@.......................................... ..t............&..H)...........................................................................................rdata..r...........................@..@.rsrc...t.... ... ..................@..@.............#pf........V...........RSDSy.~.6L.F.g."k.Z.....C:\vmagent_new\bin\joblist\815456\out\Release\en\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\appmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):31292
                                                                                                                                                                                                                          Entropy (8bit):7.98697494864025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:drQ8ffdzS2KN1gQxCFeWTuIoR7HBssluEqd8Knq:e24N6QckWT1O4q
                                                                                                                                                                                                                          MD5:DDDA5BE2E45D1C5229CD561A03825908
                                                                                                                                                                                                                          SHA1:D9207564DC229C9A05D9A7BAF8C7E2D17C62072B
                                                                                                                                                                                                                          SHA-256:C308EE41E48CC498C396A2CCBC57B7D29D058DD145F9867887544CB74112D63F
                                                                                                                                                                                                                          SHA-512:B16A67086A9D435CA17E35C7EFFDB639CF934A8671CF9F99F4E8F6846AD7E71BE71AED3BDE77A63F3189C155391EFE5287589CF6332DC8BE02E52C90C924EFB3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5.................................................................................................................a.p.p.m.o.n...d.a.t...............................................................................................................q.W.cNA6'!`;..#..[\.t.....7....{..s.....|B....H.r.%..]..b2r.K.P....7]4=....1.$9..~...(..V'Y.;...L....-...O...E.d.T.F..C).....#..w%..w.`...0....C..............0............C.F..*:...3G.!T...O.Dlo,'Q.....\S..3....c......ETN.<..#~..+>o...'L.Q.L..#.(....F.[.>.s-=?.=.u...H.b...L.\na=0'..h....Yy..H,...{..JJ...C..L......,.3..wO@K..&.Q\...5..cY&..2..).2.>.2`@VQ..UO.,d.i.F..@..;...b-<."..6:...g....i.<..0(GX...:...9.L<$."D..{.....`...=a.P..E.l... /..U<J~A.^F5sp.s.U-..Gf.R...=....'..%.>.ki..$\...N...>...A.Y...8.h.e...4...Zy._175.&.6..Ih.8.0L.=.cPD*.U...Uz..T..a'..k.po..;B....6.'.Z.'[=Z.,8.....3l[..^i.Q.-\S._{...Z..5.7....K+XD....Q.V..p......w-.9.(../.....0....,..Z...G0....ae...<.U.\.52x.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19424
                                                                                                                                                                                                                          Entropy (8bit):6.5527302391659905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:78I3ZhT+9lexj6sLU6ki2cP0iwfLaAS+ShjmM6IGBkSN:w7Gxj6af2cPfwJS+ST6nki
                                                                                                                                                                                                                          MD5:507A7B4E028D292BE4EDEDB6B3667E68
                                                                                                                                                                                                                          SHA1:752121FC2F4C4814A4C50BD6964C6237FBC69CD9
                                                                                                                                                                                                                          SHA-256:3EBFED2B2A10B33AF330AFF197905437EF3970E8C944B7970C097AC0CBB99671
                                                                                                                                                                                                                          SHA-512:0B1FB10521512426C448A85976AFE9E2E9C356768A5D2E941DE022C2194A487055C3C724C08DD4ABF1D115F24F80248CCD90A3655544DC17491F0373C603CFB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@............@.......................................... ..P............"..H)...........................................................................................rdata..u...........................@..@.rsrc...P.... ......................@..@.............#pf........Y...........RSDS.o...LF. a:.T......C:\vmagent_new\bin\joblist\815457\out\Release\en\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.968514351588424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:5vHP8qNfXOKM5VHblx1qhvmVqC7exscB3neUvESwTPprqWPQTUDnwENL1c:hHP8KX5M5VHRivmsCescReUsZPqid8
                                                                                                                                                                                                                          MD5:BD29091BA65B3FC08C79654997B4C82B
                                                                                                                                                                                                                          SHA1:3B353EC41DCC96D898715F6474656F13931C1B61
                                                                                                                                                                                                                          SHA-256:A3CFC3C8F95F0ED56306D28AC87408F10875C43BCA7778C6E1CC18C7A3441183
                                                                                                                                                                                                                          SHA-512:AE64DAE0E4025968BFB14E57C2FAAB0C9DA39943DAE9C884CBBD940433B29613C090B98899DB847C94B265F969A6ED3CFEBFF35AF284CA9619E6E25937067650
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................A..a,.@.-_...#.....2..vI...^..2..H"..........yU.;.i[..{.~:p.u.!...&..JnZ.......)px...@-T......7.HK.)...Z...[@n,4..h.C.!....#..w%..w.`...0..$................0...............q.%H...CK.d.d.=\I...).../..UQ.9z..@.(..gc3v.... ..v..+......`f.~.z........o+..}..az............(-z......3.*..7>T8O...._='..P.hX.....Itvz...r~$.....r.3....L.e..H|. z>x!;C..J..a.=..c$.....6..6..._s~..b"-...!.fI.&....w.]b......+....b...U./..m.6[.o.DS...=>..._C8.Av..yy.^*Sh-.s..Z......w\.n.;...q..h..Q.....<..V.........t.....4.6..F..=Q*..........0B..h.ja..=......|..>dz.,.)......&.......3..|..;]"q..A......R.y{.......$.d.L.:.......]j...G./<mFJ.!.,Lc.....Fcvw..{4.SH.*..m..l..|.?`N=d.l....O..y~....u9..?s....Jy..P

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32908
                                                                                                                                                                                                                          Entropy (8bit):7.98579519717503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:mqPy0zBxmlBLCxBIZuPVOWdT0bQUu9d2+8Pc1fCrGrP:m90nmlBLSBjt/T0MUu2ofCrY
                                                                                                                                                                                                                          MD5:F507C8DB8F8EC9361F36608408C9939E
                                                                                                                                                                                                                          SHA1:F3915EDB67FC281DDE5657B383E3A5AEDFE96BB8
                                                                                                                                                                                                                          SHA-256:DAB50E3C2787808BEEB0B377AD7C3DE2C518578B9F7A4EC4AC29063D59C00B3D
                                                                                                                                                                                                                          SHA-512:CB09E4F033B873211BFA8B8B82FA207EA5C176D8D686487C2253214F5F965734D2A16A04AE41B849FFA20B3B03814714274B749F07DBC28A0A5676A86630FEEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................r.e.g.m.o.n...d.a.t..............................................................................................................`1.!.../.C~.}.Q.i.{,..L......B.PG...xJ..L#.......B#.5J?.j}..f..`x.F.dG.p......."...VOn%.%M.D.;.F;.XL].o.S.DK....F[.....]....#..w%..w.`...0..d.6..............0..........X.6./).5.b..V..p,...u}".~..t...0...r..6,...c.....y..>.....lxh.t...O...-}~.c..1.'zv:..s..t^.|....%.."k.c....n.....J..x&. ._.-...\.9>.$.q.).~........v...b..IY.{...cp.f5..F.&..o.].V....0..J....w..f].%...!..\t.s+.J}....7.X..nI.z.M0...5...)x.8\G.._..w@.'..1....?=D.y.:Hw...9.@.Y.9.hd...$h^..I.G..gy..j.......5...nB.4 0!e..N...WQ.k....:x.9.`........3....38...W[..K1..{Q`..5P&z..8.J<.`.'+.i.y..0.a"Zu......KS......M..h...O..qbj..$../Z.M&...;...`..n.>..#.8. .m...|...s.$.K.T*c.....H.Z.S...P..5..#....^[.a=...........V.k..)r..%.i_.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):6.818502996360454
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7p82Phneq2+m06ki2cP0iwfL46SIS+ShjmM6IGBkSvA:c+m/2cPfwHXS+ST6nkz
                                                                                                                                                                                                                          MD5:4F7FEBE3F590F61FBA281D6D48063AEC
                                                                                                                                                                                                                          SHA1:2A978CF218EE950728452E62A7E274F0F7B0F346
                                                                                                                                                                                                                          SHA-256:285B8717038589756ED43BBEFEC8D010FDFDA1B9726606332C1E3601CF6E43FF
                                                                                                                                                                                                                          SHA-512:55193636F87924A75E2EEECBCE50B19E7D1320698CDC58FEF62DCE807C0D462429D6A3034C2EB9E297012E67ADFB236DB91D05EDC4E3514A33017CD379AC3E15
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...cfrf...........!.........................................................@............@.......................................... ..................H)...........................................................................................rdata..t...........................@..@.rsrc........ ......................@..@............cfrf........X...........RSDS8Be.RAIL.Bmd...a....C:\vmagent_new\bin\joblist\815994\out\Release\en\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1060, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1085440
                                                                                                                                                                                                                          Entropy (8bit):6.8305235705939795
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:jMMZ16POkiYTP23w+3Jezzf7iQvTiB8B3p1pK6hX0:f6phP23PJezzDxvQF
                                                                                                                                                                                                                          MD5:01C51B8DEB92563910D5218B47E08D45
                                                                                                                                                                                                                          SHA1:2D467000D8C369F14F5BDD01724EA78998867C53
                                                                                                                                                                                                                          SHA-256:9CEB8067BCD33577F67822ED6FC113DC5C67B35393BD351614F7DAD212CD4D27
                                                                                                                                                                                                                          SHA-512:E2AF0CA84846AEB92D606F3E541978FE186BFBAD914F65A2FA0DE7397A6AB5AEC113D170A275EBBCE24E48AFB8FC749E0CCC2A654C555C0FA476EAE2D26CAC90
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......$.................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 240, database pages 791, cookie 0x8, schema 1, UTF-8, version-valid-for 240
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):809984
                                                                                                                                                                                                                          Entropy (8bit):5.834884023815519
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:A/nCExkRpiJhfKNJhhD5PpS1t/PUTmuisxaA8Fnf2:CCExkRgJhfKNJLhctnUTmuTaAP
                                                                                                                                                                                                                          MD5:8785E4BC6D7CCBA8D94085727D21A8A2
                                                                                                                                                                                                                          SHA1:B8CF1FE966BD3181F538424B163AA6F558CBEE3B
                                                                                                                                                                                                                          SHA-256:58286C9F943609D92416473817CA8618356F5C9A64CD83DF4F5E9611D4E04CF4
                                                                                                                                                                                                                          SHA-512:8D0790A94BDCEA82809B9671B0C4B087B191FE99A3AF75FE446CC64F218D14E7381DEFA82042D1B0D2E47F5823C31CCB6280A7A3AEAAB852B6D48C0596744728
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.........................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32584
                                                                                                                                                                                                                          Entropy (8bit):6.027932340454107
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7baacsultAgwBAP3Excizfb5pei1QcMCPHz7eMKw8n:at4B23ESYf1Mi1+Hn
                                                                                                                                                                                                                          MD5:9259B466481A1AD9FEED18F6564A210B
                                                                                                                                                                                                                          SHA1:CEAAA84DAEAB6B488AAD65112E0C07B58AB21C4C
                                                                                                                                                                                                                          SHA-256:15164D3600ABD6B8F36AC9F686E965CFB2868025A01CDED4F7707B1AE5008964
                                                                                                                                                                                                                          SHA-512:B7B06367BA9AA0C52AC5CFC49D66E220232D5482B085287C43DE2EF8131F5EE703FFEB4D7BEF0E5D9A430C0146BB2AB69C36174982184A0C06E6BEDA14E808B5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....k.S...........!.........`...........................................................@.......................................... ...\...........d...............................................................................................rdata..q...........................@..@.rsrc....\... ...^..................@..@.............k.S........U...........RSDS,].s...N..bz........C:\SVN\Safe4.0\i18n\I18N\SPTOOL\EN\Release\360SPTool.exe.pdb........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2274
                                                                                                                                                                                                                          Entropy (8bit):3.5677037803929657
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uNYNWWwqwVCrV0wS7whURlcxLDwrNNw1gnbYma8iIk:r3Ny//YsGrNRKenb7iJ
                                                                                                                                                                                                                          MD5:94EC0DFDC4E489C654DD8DCE666D5EB0
                                                                                                                                                                                                                          SHA1:A27D55AA4E680C4CF32E01E12C7C0AA21A7583B9
                                                                                                                                                                                                                          SHA-256:5333872D10A61FC99F16DFD6B648E08BDD4FD3B0AFC273C71D0D0FDD8470BDAA
                                                                                                                                                                                                                          SHA-512:91B68C1180BC80F20C93FE913DA511EE16607580E75D37801B012771E1E41783458F9EF269FE49623D677A2D4D673D29269B3D2A344631B620705CACD47391AA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=.U.n. .p.r.o.g.r.a.m.m.a. .c.h.e. .a.c.c.e.d.e. .a.l.l.a. .t.u.a. .w.e.b.c.a.m.....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=.U.n. .p.r.o.g.r.a.m.m.a. .s.o.s.p.e.t.t.o. .s.t.a. .c.e.r.c.a.n.d.o. .d.i. .a.c.c.e.d.e.r.e. .a.l.l.a. .w.e.b.c.a.m.....I.D.S._.T.I.T.L.E._.R.E.D.=... .s.t.a.t.o. .i.n.d.i.v.i.d.u.a.t.o. .u.n. .t.r.o.j.a.n. .c.h.e. .s.t.a. .c.e.r.c.a.n.d.o. .d.i. .a.c.c.e.d.e.r.e. .a.l.l.a. .w.e.b.c.a.m.....I.D.S._.N.O.T.E._.B.L.U.E.=.S.e. .n.o.n. .h.a.i. .a.v.v.i.a.t.o. .l.a. .w.e.b.c.a.m.,. .t.i. .c.o.n.s.i.g.l.i.a.m.o. .d.i. .b.l.o.c.c.a.r.l.a.......I.D.S._.N.O.T.E._.O.R.A.N.G.E.=... .s.t.a.t.o. .i.n.d.i.v.i.d.u.a.t.o. .e. .b.l.o.c.c.a.t.o. .u.n. .p.r.o.g.r.a.m.m.a. .s.o.s.p.e.t.t.o. .c.h.e. .c.e.r.c.a.v.a. .d.i. .a.c.c.e.d.e.r.e. .a.l.l.a. .w.e.b.c.a.m.......I.D.S._.N.O.T.E._.R.E.D.=.S.o.n.o. .s.t.a.t.i. .i.n.d.i.v.i.d.u.a.t.i. .e. .b.l.o.c.c.a.t.i. .t.r.o.j.a.n.,. .v.i.r.u.s. .e. .p.r.o.g.r.a.m.m.i. .p.e.r.i.c.o.l.o.s.i. .c.h.e. .c.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):108544
                                                                                                                                                                                                                          Entropy (8bit):5.334911052722087
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:PORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3e:POBrUC4jyUJGKzgSg+Yco46Fe
                                                                                                                                                                                                                          MD5:7BDAC7623FB140E69D7A572859A06457
                                                                                                                                                                                                                          SHA1:E094B2FE3418D43179A475E948A4712B63DEC75B
                                                                                                                                                                                                                          SHA-256:51475F2FA4CF26DFC0B6B27A42B324A109F95F33156618172544DB97CBF4DDDD
                                                                                                                                                                                                                          SHA-512:FBED994A360ECFF425728B1A465C14FFE056C9B227C2EB33F221E0614984FD21670EDDB3681C20E31234A57BFE26BCF02C6A3B5E335D18610D09B4ED14AA5FB2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........l......................................................z.....@.......................................... ...i...........p..h7...........................................................................................rdata..............................@..@.rsrc....i... ...j..................@..@..............2\........w...........RSDS.).s.rCL..vwZ./B....E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\en\Release\360procmon.dll.pdb......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):53368
                                                                                                                                                                                                                          Entropy (8bit):5.901434301235028
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:O3v+tnPKY4PWWYzpnD9UT1tFGHXjpjqdV9/rfroLoZeNMXN+6Ampc:9KJSpD9+1tFGHXt+PtrgINVni
                                                                                                                                                                                                                          MD5:A891BBA335EBD828FF40942007FEF970
                                                                                                                                                                                                                          SHA1:39350B39B74E3884F5D1A64F1C747936AD053D57
                                                                                                                                                                                                                          SHA-256:129A7BA4915D44A475ED953D62627726B9AA4048FFCC316C47F7F533B68AF58B
                                                                                                                                                                                                                          SHA-512:91D1B04D550EDA698B92D64F222EC59C29B5842115B3C3F1159313B620975BC8475B27151C23F21A78F60ABD6C7FA9CE5CB1EA45F9349942338F9BF0C8CFC99F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...|.U.........." .....Z...Z.......................................................G....@.....................................................(...................................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):6.704024547095587
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7PEyLnAYEFPrQP8tVku+pdhh2eryHU8/7X8r9ZCspE+TM4rSEZsBHUckAwmTcViv:7iYsPVI70HVJeM3Hl7VLQKvrfpMQ3vmc
                                                                                                                                                                                                                          MD5:9D8DB959FF46A655A3CD9CCADA611926
                                                                                                                                                                                                                          SHA1:99324FDC3E26E58E4F89C1C517BF3C3D3EC308E9
                                                                                                                                                                                                                          SHA-256:A71E57CAFB118F29740CD80527B094813798E880DE682ECA33BFE97AAA20B509
                                                                                                                                                                                                                          SHA-512:9A2F2D88968470B49D9D13569263050B463570C3CCE1B9821909E910A8A358E64AD428B86095A18F596D2B3ED77E0E21D40F9C24543E4A0872E6B35C5103BEDE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........................................................0.......t....@.............................................................h7...........................................................................................rsrc...............................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...............................................................................................................................................................................................................................................(...8................................................ ..D...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.119162926186316
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7wB600ZGYbI7nOSeM2kPj9C3A8nQJ+MQ3HC:0B600ZYKkL98AnJ8C
                                                                                                                                                                                                                          MD5:EF81EE8D0D3576979D8601DEA4701034
                                                                                                                                                                                                                          SHA1:F8E279B8B6801F800066233B462A265DC3E97DF6
                                                                                                                                                                                                                          SHA-256:D3972848F049357FCA4F33CB1864191FC47F461ADC3ED314574307CBAEBA3F27
                                                                                                                                                                                                                          SHA-512:1A82BCB564A31677637CC92B1A4BC129CEEED16C4034C19AC4083347ACA91B6160A1876D3809C35B2B6A9DA88BAD4A406BB0933AEBB67BB76A6725DD4485892B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0............@.......................................... ...................7...........................................................................................rdata..}...........................@..@.rsrc........ ......................@..@...............[........a...........RSDS-..^<..I..c.........C:\vmagent_new\bin\joblist\259671\out\Release\it\UDiskScanEngine.dll.pdb............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19512
                                                                                                                                                                                                                          Entropy (8bit):6.982014658903312
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7BRsgImz0QeR3K+h1MeK6jODGPhCvQKvrfpMQ3Pe:NugZ0R9K0MeKgODG0QwZe
                                                                                                                                                                                                                          MD5:8644A59029D3AEEBB23FFDAC96341009
                                                                                                                                                                                                                          SHA1:FB87BEA0612F08D5F0F393DBF1D07D5A6F155080
                                                                                                                                                                                                                          SHA-256:86AB9E530C066F494718CE61538A481AD1316DD1AE0EC027ACFFA3F26BDDFCA5
                                                                                                                                                                                                                          SHA-512:DBB03AFB3751214FC132D8412023CFBB477CC735A80BE26DA92AF54E96A0C74439E95A60F1EEE4322BA33A8AC146CE2E5B21FC316BBD8BE72FFE0337B836A6FD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... ......T.....@..............................................................;...........................................................................................rsrc...............................@..@....................................................................8.......P.......x...................................................................................................`... .......................8.......................P.......................h.......................x...............................................................................................................................,...............8...........T...............................................$...................Z.............I.D.D._.D.L.G.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54392
                                                                                                                                                                                                                          Entropy (8bit):6.2287339496325265
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:fCG11xWF7Lp/El6Eh7lKlI019+6JWaeNMXXbBA0bg:KGa7l/8h7I7JWpIXbBA0bg
                                                                                                                                                                                                                          MD5:770107232CB5200DF2CF58CF278AA424
                                                                                                                                                                                                                          SHA1:2340135EEF24D2D1C88F8AC2D9A2C2F5519FCB86
                                                                                                                                                                                                                          SHA-256:110914328D4BF85058EFA99DB13BFEC2C73E3B175B91DFD6B41C6FA72EBAA103
                                                                                                                                                                                                                          SHA-512:0F8B98DED900D9421EB90CFFD527D8218B14354D90B172D592C4945C482191D5E512F2678217C6214ADDB38DA0B9BB9287F84963A50447CF232962BD99B0C3E8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...;.U...........!.....d...T......B...............................................:.....@.....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc...............................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.7828295966719985
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7LyM4ZuyMrj1grjzR+vnr9ZCspE+TMAr3o7hu:7eVzM8z7eM97hu
                                                                                                                                                                                                                          MD5:22A6711F3196AE889C93BD3BA9AD25A9
                                                                                                                                                                                                                          SHA1:90C701D24F9426F551FD3E93988C4A55A1AF92C4
                                                                                                                                                                                                                          SHA-256:61C130D1436EFBA0A4975BC3F1C5F9FDF094A097D8182119193B44150344940E
                                                                                                                                                                                                                          SHA-512:33DB4F9474DF53CE434F6E22F6883DA100473D1B819984171356EEEF523BA534C4ABAF2536596B8758358E755E5D9F3793D85BE12D2D8D5284FC7D13F6C005CD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ............@.............................................H............................................................................................................rsrc...H...........................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .b.r.o.w.s.e.r...M.i.c.r.o.s.o.f.t. .E.d.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.700779948402696
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7VCMqB8x3yMrj1grjzR+vnr9ZCspE+TMAruNNNQkG:7cXyCM8z7eMlVG
                                                                                                                                                                                                                          MD5:5823E8466B97939F4E883A1C6BC7153A
                                                                                                                                                                                                                          SHA1:EB39E7C0134D4E58A3C5B437F493C70EAE5EC284
                                                                                                                                                                                                                          SHA-256:9327E539134100AA8F61947DA7415750F131C4E03BBB7EDB61B0FAB53EA34075
                                                                                                                                                                                                                          SHA-512:E4EA824314151115592B3B2AD8CD423DC2A7183292AA165F74F8E35DA4F142D84D296D34506F503D448C7BD423BE6BF04DA2412B7DAF474FBF4EF6A2AF142BFC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... ......|.....@.............................................................H............................................................................................................rsrc...H...........................@..@....................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .b.r.o.w.s.e.r...M.i.c.r.o.s.o.f.t. .E.d.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):476
                                                                                                                                                                                                                          Entropy (8bit):3.684741652257272
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Q++ubxFem0GQvLpkRhR4kevgE5IxE9zeHMkZItE9YIEI:Q++uVGHaYzOMkZRVT
                                                                                                                                                                                                                          MD5:9E4645CF4440764B3368010956C9C188
                                                                                                                                                                                                                          SHA1:016D2099FE7801B5F29EE1EBBA46026185FBE795
                                                                                                                                                                                                                          SHA-256:A34F902B7FBC6DBDB1046A254706B0411FF571696425D159546FBF2CD141558C
                                                                                                                                                                                                                          SHA-512:217BF589F6AB24BCA846665201064CF5629A2E8BD93A4B0CDC7204E98B77BC4CBC977150A37DC8CA1739EB7A74A166178E38BDA6576CE46D421410466887B94B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=.R.i.p.u.l.i.t.o.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.F.i.l.e. .s.o.s.p.e.t.t.i. .d.i. .U.-.d.i.s.k.....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=.R.i.p.u.l.i.t.o.:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=.R.i.p.r.i.s.t.i.n.a.....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.C.a.r.t.e.l.l.a. .n.a.s.c.o.s.t.a. .n.e.l.l.'.u.n.i.t... .U.S.B.....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=.R.i.p.r.i.s.t.i.n.a.t.o. .c.o.m.e.:.\.n.%.s.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8500
                                                                                                                                                                                                                          Entropy (8bit):3.557951484666829
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVl5ENqWIajuwapG4i8nc6WSbJ1J9Wd6AFWbmc:29+DgRgizMG4i8nxWHFWT
                                                                                                                                                                                                                          MD5:47383C910BEFF66E8AEF8A596359E068
                                                                                                                                                                                                                          SHA1:8EE1D273ECA30E3FA84B8A39837E3A396D1B8289
                                                                                                                                                                                                                          SHA-256:B0A2DD51D75609B452A16FB26138FB95545212EB6EFA274F2751EB74CCC5633F
                                                                                                                                                                                                                          SHA-512:3D307569452EC6D80056A3A2E0225D559606DEAB9A6C3913C1FEF7ED6ACA476D7A00190B1BBFA3D032411C2F52427F3096FCE7B7952479AD9B75AA3CEF59D7B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.337107604440134
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLscg6PCabR:r5u5/+mMks5qTp1mNqce9OoD6aabR
                                                                                                                                                                                                                          MD5:75C25136EC86767B6416E7EF428D56D1
                                                                                                                                                                                                                          SHA1:826DCCEAAD7AEDC9A52695A847CD32731C6BE343
                                                                                                                                                                                                                          SHA-256:944799ABAB049D9D9D6159CB087447B4390B901A4159F3130B7E99A3D199E7A7
                                                                                                                                                                                                                          SHA-512:90F48AF1C8800C85D13F57E5BC01ECFD25A9247F143EA67DFD37B9A9049CCC2F2263AAB7FAEC7664635FB29FBFC16EE4C8FB491A50A8227BE05A27EB0881F5C2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\it\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10568
                                                                                                                                                                                                                          Entropy (8bit):6.811594221456347
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7jp0kvNyMrj6Pu7CrjzR+vnr9ZCspE+TMorCxu:7jpJMMCPHz7eMtu
                                                                                                                                                                                                                          MD5:5EFD82B0E517230C5FCBBB4F02936ED0
                                                                                                                                                                                                                          SHA1:9F3EA7C0778FEDF87A6ED5345E6F45FB1BD173FB
                                                                                                                                                                                                                          SHA-256:09D58A2F0656A777A66288AC4068AA94A2D58D0534328862B8371709EAB2003B
                                                                                                                                                                                                                          SHA-512:12775C718F24DAA20EC8E4F3BDEDE4199C478900B12ADDCB068AE7B20806850FDC903E01C82E6B54E94363725DCFF343AEAC39C3512F5EA58D1BA8D46712AD33
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......S...........!......................................................... .......0....@.............................................d............................................................................................................rsrc...d...........................@..@....................................................................(.......P.......h.......................................................................................................................................................................................(.......................8...H...8...............................................x...............Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.f.o.x.,.I.n.t.e.r.c.e.p.t.e.d. .%.s. .v.i.s.i.t.i.n.g. .%.s. .[.H.a.r.m.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):95808
                                                                                                                                                                                                                          Entropy (8bit):6.492577239565757
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:9mvblAch7lbRonR0isKCzvEwqn89DMBPOWsbdZ6:9ubRoR0ishvENAvWsbdZ6
                                                                                                                                                                                                                          MD5:91DE8596106D58C1844F74F925A31609
                                                                                                                                                                                                                          SHA1:A84E5BC2CC73612E3C9278F8E29FD9E53B2573DF
                                                                                                                                                                                                                          SHA-256:69FF61EC1147E66F4CBE68C02B328DC477BD8332CF9F19517FC7FD457B2B8FB8
                                                                                                                                                                                                                          SHA-512:B0F0B54729143D9C80F324FD82929B1445BAFA4349266D31D01CEE8D6FFD78ABD7C194E6544967C7D1D6BC7BE18EAB8AF085C619F8162E132859339DCE042807
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L...m..[...........!.....d..........B........................................p............@....................................(.......`............>...7...`...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc...`...........................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1228
                                                                                                                                                                                                                          Entropy (8bit):4.797889788226547
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q++uLTa0VgzNVn0GZZFIeEzgWKchp4KMdZuYKX7xiWATejaIV:r+uLTa0VyNmGzueLWjhp4ZRY7xqTemW
                                                                                                                                                                                                                          MD5:3BC5E87E0F5F78E1C9EBC3845C129C6A
                                                                                                                                                                                                                          SHA1:17DBB327BF7C76D8A6CF33D51291B6D9124279B7
                                                                                                                                                                                                                          SHA-256:3C706596256255CC9DB5A37FC6E367E8BDA56D0DDBF2F4F78E9E1DC71032DC48
                                                                                                                                                                                                                          SHA-512:8E5B111FC4D51B9E09A9592C76A72E471D6DE2CEE8D28DF73189DE1A46B433F8E0F023731ABA04020AA86930FBCFA732EF7A1B28DF509F12F39C41803A6B24D8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y. .-. ..0.0.01XJT....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=. ..[L.-Nk0.'Yj0.0.0.0L0zv.uW0_0_0.0.0.0.0.0.0.0.0..X0~0Y0.0....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=.T0...`.0J0K0Q0W0f03uW03.B0.0~0[0.0.0....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=.J0.OD0n0.0.0.0.0.0k0.0.0.0L0zv.uW0_0_0.0.0..X0.0._..L0B0.0~0Y0.0.N._n0...Tn09e.Uk0y_.zf0.0_0.0.0.0.0.0.`1X.03.6.0..0.0.0.0.0.0k0...OW0f0O0`0U0D0.0S0n0.`1Xk0o0.0.0.0L0zv.uW0_0.0.0.0.0.0n0.0.0.0.0.0.0`0Q0L0+T~0.0.0.0.0.0.0n0.0.0.0.0.0.0.`1Xo0~0c0_0O0..2.U0.0~0[0.0.0....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.2.=.S0n0OUL..0g0M0.0P..0.e.gk0.zlY0.0_0.0.0#.a}.e.l.0....W0f0O0`0U0D0.0....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.R.E.S.T.A.R.T._.C.H.E.C.K.=.S0n0.0.0.0.0.0.0.Qw..R....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.A.U.T.O.S.E.N.D._.C.H.E.C.K.=.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\LibSDI.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):103500
                                                                                                                                                                                                                          Entropy (8bit):7.998448676055069
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1536:s+WtM4SPIeKUfcdILnLpx+GVXWWhbwexe5iJBaEyXcR3ezf22lXmmOC+ND:ctneKZILLpxlFve5xcR3ezf22sJD
                                                                                                                                                                                                                          MD5:6E780467019CB4B54808B185B514512D
                                                                                                                                                                                                                          SHA1:2AA61812069E8589A4565CA4419C745CB0BD16AA
                                                                                                                                                                                                                          SHA-256:19D32DCEE8AD638E53912DB6F94B5CE42149096AE32B7532EEA57590A731A7B3
                                                                                                                                                                                                                          SHA-512:C4F8B823B2FE1D7A3368A021FA59870DEDE17F392AEBAF56A3D194CA4A0F4A51C17E2346AF9381963DD710AD41BE739BD14B1CBC13AD2220526BA193C6B2B0CD
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..Y....&cP....!.T...TP..@.. ...6.t...f......&.W..d..E9.f.<...(.T.G......g.,`.BTU..9....YgXJ.E.b..o...y.m.v....a...r...&.<.8....).|Rd..7Q.1..S..'..ma.../D...@".s.u...Yb...G.....L..v...J.v...m..*1P.O].H.....D...j....E.hC..*@ =.O|...[G....K....".O|.<N0Z....'j..OX..p.h.T. ...XB.#4.R....01...F..S8"........j.:...................*....u..........P,.l5._..9"<8a.d.Z.m...F._...~....7`............E..@...Y.....]....?5...J!4P..8.W!#....i............... S.fM4...j[......?/.M24..."..G.F.....7>.:yv2..8.]..w.T.:.m.$....v].y>...]....#......9.....$4.Y]G..s.|.Y..(..*..2.y[,P..W.W.MZe-3|QENqcG$...n.y.(....G......Z8.G;..`.Pf.....y.m'{H.s.7..P...Pv..qK...........[....+..9:;!..2.+w...&.....pM.D.....v...}U....xOF.I.L.1..`^/.x?.W_r........F[5.&...%..3.D..q<.m.3A.4..>0....*!F........6..Z...D...c.`...F.:.4wr.3..x..._...0..."p.*.*Ekn.........6S.~...I.,...".z...:..k.3.S.}.;.../......s.... ......$R..(..N0G}.(R..*..E.l~..s.0...s...../.. ...nZMI.Nc..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.61925993997985
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7OOMtGLsJltDGQWjveCEI7nOSeM6jcA8nQJ+MQ3na:SOMt4KDGQWKmccAnJoa
                                                                                                                                                                                                                          MD5:4D8A3E57F5FF4648715FFAD1B71A0D06
                                                                                                                                                                                                                          SHA1:96C26D359B5F4DAFCB3B9B85A57A9EB7CEE9C7B3
                                                                                                                                                                                                                          SHA-256:D57E8B48025E3C2DB2296759501E515AEAD5DB28C6B2F7D80EDFBA8F8A7D822F
                                                                                                                                                                                                                          SHA-512:FF0B48666037EB5A292A021B03ACC9F3F563F7F66FDAAA638647E6AD366627AA12EF9B474504B55944C474C58CD9CA0C890208508B83C6838BCC5E3EF5056465
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...Y;.[...........!.........................................................@.......t....@.......................................... ..$............ ...7...........................................................................................rdata..y...........................@..@.rsrc...$.... ......................@..@............Y;.[........]...........RSDSI.DD.J.M.,..c.6.....C:\vmagent_new\bin\joblist\258920\out\Release\ja\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):86584
                                                                                                                                                                                                                          Entropy (8bit):6.542284169509256
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:82kLlARh7AKRobMqR7RKJOnBhAIknRB5T/3WBjEL7Y1f6Bu9we:8fKRowqR7R6OBiRB5D3WpEL7YdF9
                                                                                                                                                                                                                          MD5:520D7010A344F8FB4AF7B1A80F81025D
                                                                                                                                                                                                                          SHA1:805A98F9D334E540356356C3D113620FECA3AD3E
                                                                                                                                                                                                                          SHA-256:EC82B3DB6B7CAB1EBA4C239217C208013DE7289B83DE1FA55F8BFCB2E14D2381
                                                                                                                                                                                                                          SHA-512:30600094547553E3376D6E0DD9EECF44A231D88E9CC7327AAAEDD89E105C0271F8E3BAFA529FF7FE74A544F77A0AE97F083907FC0C47FF425FF6870B2EFD3DB7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................P......p.....@....................................(........s...............;...@...... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc....s.......t..................@..@.reloc..r....@......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):79960
                                                                                                                                                                                                                          Entropy (8bit):6.398370926486835
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:aWPrlAMh74pKFRo8QqR7RLJOnmwAI8s6C5T/3WqjEv7v1BhBI0:alpKFRo8QqR7RVOm66C5D3WSEv7v
                                                                                                                                                                                                                          MD5:B922913891078EE52F02A1AFFADACC1A
                                                                                                                                                                                                                          SHA1:B934E180D672DE3CF85B51E318B7D2778E33A4F1
                                                                                                                                                                                                                          SHA-256:09F196AEF97DD1968E7EB779438BF5382119A8BF47C57F7FCFDA378CB902D7A6
                                                                                                                                                                                                                          SHA-512:92275B9DE3B9337D6725559FA7915E2951334CD18CCEE6599D17BFAAAC9975A0547A65E4D769D4F3892F2181780CD233D52FA93F1E851BE8B3377F335CB68628
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L.....-V...........!.....d..........B........................................P............@....................................(.......Pt...................@...... ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc...Pt.......v..................@..@.reloc..r....@......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75320
                                                                                                                                                                                                                          Entropy (8bit):6.6259259018440355
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:GmvblAch77tRoxqR7RKJOnBhAIkAY+BPoy9wedJ7:G8tRoxqR7R6OBkfy9R
                                                                                                                                                                                                                          MD5:3F69CF12A81490C6E54EC7EF6D6C29FF
                                                                                                                                                                                                                          SHA1:2EFC4E276140081638EFD8B46D6448DABDFE9C03
                                                                                                                                                                                                                          SHA-256:A80EFEC307A15565951B9222A2C63D490F6584A3AA2964A5416736AFADE0EB70
                                                                                                                                                                                                                          SHA-512:6014834819DFEECABD54A76E8CE339DDF6DBAF85A0937458B51114372417F8F74FF2B10D2F7438398B27914C1EECE4B372556C5DB5B5AEDE95B4241AE618B1D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................ .......,....@....................................(........G...............;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc....G.......H..................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\deepscan\dsconz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19071
                                                                                                                                                                                                                          Entropy (8bit):7.990304556001079
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:384:YAG4SpbwEKYAbje8a66SbGYQoYtIglDTuREcPJ8hzyB8l794tLB15Q1:sbSj0SbDQoYZlDT9cPJUzyBwhE21
                                                                                                                                                                                                                          MD5:08BBFAA6C52F740240796F9B9A4A33DB
                                                                                                                                                                                                                          SHA1:5B816B26089A01634F65240D62DDF4C7370C50D2
                                                                                                                                                                                                                          SHA-256:1E25967BC53EF1716B7724ED9FEB8C4CC632B4D486CB27AF57311C8D1D5FE65F
                                                                                                                                                                                                                          SHA-512:38285ABB711A04224E16FEC8C584532EF994753BD493AEC96052A12D7C592E9084F03474C2DCACC149456A5F09B62144060E457320F5EDE2144207FE7D89941B
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............CJ..m.@ehH.....y........L................LLLD$.HLLLLLLRLEL.... ..{.....5lG..]jo.{[T....._.... ...B.+C.|..D^..H..R`.I[...BM....9.~.x.N31...pK...U.O..''z...w...XA...P...5X..nP..$.DdP<VdF.`d.V...&....h.y.b]7..P}...~..3..3...[c....1..s...[............j.....P.v...i.H.t......d.4.Q.V.KJ%......q....j+.3...b.i..[.....8...Sdy.....L81Dw5.9.%...9...5..!yk..H.IV...6.q.VW..G.3{&)E..{. ..v|K$.....E.gC@a...<t.....cy.4...~..r.$bH.Y...L...F..gN..O....6p..We..N...r{.9..;=.%..O..%]=..J.Y=#...//U.=>...F......G^........p.........c%.a.I#...G...8..8.or......!....o.S..6...L......1.c..CM.m...R.^.[:.@.0..6.j.v..A..#.&..+-..C...E.}./T...>...F......C..A...<^k.{Q,.2xaU...C%%U..m.....<....D....@.~.p......D...=JJ..q.G@...It...TI...?~.._._%5...L......ns.Y..k.....g..............XW7..CzZ9....ce@..M.....d...H9qB..J.%.......t...(.t.....5.i.2h).jK[.B3.\U.hW...aR.....sN.>..B.I:...n...3.U'.3.2.&......%-...dSM.,.Zx0..G7....myc....l...,.=.;d..f..l..|...!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60938
                                                                                                                                                                                                                          Entropy (8bit):5.558204222119754
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:JAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyA4:jM4A6UAHRHF4aIn
                                                                                                                                                                                                                          MD5:C3366C2D19259FE2451907D6B69AD1EA
                                                                                                                                                                                                                          SHA1:9D5550B7D7198482B33F9C5721F54281FC79F272
                                                                                                                                                                                                                          SHA-256:E5B5D270FCC12CA1142DB45A2CAB314246EA6086E5CC9589844088C22EA328C7
                                                                                                                                                                                                                          SHA-512:8E85153D54F4A899EF14CB0454504FA3517C81793F13FC1FD77AD87EB9929E241CB6BE0362B995F97F5EB5805D71D038B280D2408A7A5C5566DCB6C94CF2658E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...................../V................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24128
                                                                                                                                                                                                                          Entropy (8bit):6.859223639703651
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7as0Migg7U0BBAPct5Gl6I76eR3KJ1M6DGPhCgyov05MQ34:2RMsVBV5Glxb9KvM6DG8ot
                                                                                                                                                                                                                          MD5:428A0555A34E3AB7741863A983C207FB
                                                                                                                                                                                                                          SHA1:78406ACC6F42880661139F4489C53CC9BE6EE1A9
                                                                                                                                                                                                                          SHA-256:4C53A0EC712B0C87F818B222B90DC5722D863C11D50099897C7F4DF971725C3F
                                                                                                                                                                                                                          SHA-512:7D44DBF0331649785A098E2C3F2683B93E77D28DE4980DEC6DB59D0490599C4197B82CB9E24F3AA08E1D15256F260281AA291D1CD12F07D662321B35A252A47C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!........."...............................................@............@.......................................... ...............&...7...........................................................................................rdata..y...........................@..@.rsrc........ ... ..................@..@............. ._........]...........RSDS.......L.ns.(,9.....C:\vmagent_new\bin\joblist\503376\out\Release\ja\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49272
                                                                                                                                                                                                                          Entropy (8bit):6.380467480514742
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:uy2lF/WFLLpAEl6Zh7laV5tp01ltY+6JWDQfedv5B9PG5:H2kLlARh7ZqJWcfedv5B9P2
                                                                                                                                                                                                                          MD5:BA400B2E72E778CAF107A329588FFD46
                                                                                                                                                                                                                          SHA1:ED4D0BD719DDDBA8B5A3E17AE4267201607E2B6D
                                                                                                                                                                                                                          SHA-256:12FEB4F47C6237217AFB846CDA758528482A0B6393D5622CE836690ECA9F2C47
                                                                                                                                                                                                                          SHA-512:5D935B6E195D2A21DCFB8608B773B29E4FE849901088364DEDBC8E656593AD356458E85468AC48825A0F26EF727443CD0E4DC4A9CAB8DAEFB8D88BBB3A54F88F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...[.U...........!.....d...@......B...............................................P6....@....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):47736
                                                                                                                                                                                                                          Entropy (8bit):6.076382501048848
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:XXHGdBPASgYoH6dzSnq5TmtzG3TpMtaIV/J8lAoHSrtq9uI:SASgRcSqNmtzG39MkyeAySrtuuI
                                                                                                                                                                                                                          MD5:C987FA593291587AD9DFE12BE606B87C
                                                                                                                                                                                                                          SHA1:D13A2D6F93AE124538D690834C8583309EB37025
                                                                                                                                                                                                                          SHA-256:11A78F35EB93ADD0D3C316CA49D0FECDB11938E56712C0672D30CF20A709D1EE
                                                                                                                                                                                                                          SHA-512:6A344BD12C7199D266DF2CC93ABF2FEFD21314422FA1E8BF877AB2C1D2769422EA58A51C386693DD30186F48A7522B623B20BED32E30CB701611E163BC7542C4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...N.U.........." .....Z...D......................................................m.....@.................................................`...(...................................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):18400
                                                                                                                                                                                                                          Entropy (8bit):6.970226908109878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7/akCYFcXngYL1t6WB6ki2cP0iwfLbzBS+ShjmM6IGBkSf:7akCYFc3zLj6L2cPfwDBS+ST6nkE
                                                                                                                                                                                                                          MD5:6D9EAC30192C811ECB85F78ED2F322F1
                                                                                                                                                                                                                          SHA1:4A4A710F15B8C02F98B4A0A650898A6F28DE99A5
                                                                                                                                                                                                                          SHA-256:0F1E6A910E09E5912DA81A83BB39C39EF6C158716E00A2ED6E6B4943CF4DB929
                                                                                                                                                                                                                          SHA-512:B980FB2303E7E6EBEF55DBCB019FD2FF6DBC069EA47DD862CA7F560A7CCF249BCC293C0C4B7E519CDD2BAE7B826E822F9DAE5D773ECF52046C22D67E0E554418
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@.......m....@.......................................... ..................H)...........................................................................................rdata..r...........................@..@.rsrc........ ......................@..@.............#pf........V...........RSDSc..p..KA...,.V).....C:\vmagent_new\bin\joblist\815456\out\Release\ja\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\appmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):31292
                                                                                                                                                                                                                          Entropy (8bit):7.98697494864025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:drQ8ffdzS2KN1gQxCFeWTuIoR7HBssluEqd8Knq:e24N6QckWT1O4q
                                                                                                                                                                                                                          MD5:DDDA5BE2E45D1C5229CD561A03825908
                                                                                                                                                                                                                          SHA1:D9207564DC229C9A05D9A7BAF8C7E2D17C62072B
                                                                                                                                                                                                                          SHA-256:C308EE41E48CC498C396A2CCBC57B7D29D058DD145F9867887544CB74112D63F
                                                                                                                                                                                                                          SHA-512:B16A67086A9D435CA17E35C7EFFDB639CF934A8671CF9F99F4E8F6846AD7E71BE71AED3BDE77A63F3189C155391EFE5287589CF6332DC8BE02E52C90C924EFB3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5.................................................................................................................a.p.p.m.o.n...d.a.t...............................................................................................................q.W.cNA6'!`;..#..[\.t.....7....{..s.....|B....H.r.%..]..b2r.K.P....7]4=....1.$9..~...(..V'Y.;...L....-...O...E.d.T.F..C).....#..w%..w.`...0....C..............0............C.F..*:...3G.!T...O.Dlo,'Q.....\S..3....c......ETN.<..#~..+>o...'L.Q.L..#.(....F.[.>.s-=?.=.u...H.b...L.\na=0'..h....Yy..H,...{..JJ...C..L......,.3..wO@K..&.Q\...5..cY&..2..).2.>.2`@VQ..UO.,d.i.F..@..;...b-<."..6:...g....i.<..0(GX...:...9.L<$."D..{.....`...=a.P..E.l... /..U<J~A.^F5sp.s.U-..Gf.R...=....'..%.>.ki..$\...N...>...A.Y...8.h.e...4...Zy._175.&.6..Ih.8.0L.=.cPD*.U...Uz..T..a'..k.po..;B....6.'.Z.'[=Z.,8.....3l[..^i.Q.-\S._{...Z..5.7....K+XD....Q.V..p......w-.9.(../.....0....,..Z...G0....ae...<.U.\.52x.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17888
                                                                                                                                                                                                                          Entropy (8bit):6.888830119337913
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7qUP9JLuQ+9lbVFajIgDXNv6ki2cP0iwfLwGFdlT1S+ShjmM6IGBkSHUk:/P9JL4RFajIay2cPfwRFrT1S+ST6nk+
                                                                                                                                                                                                                          MD5:A645907E5EB419EA846E1955955BAEE7
                                                                                                                                                                                                                          SHA1:BD0FA955129627B89EAE23374BA1DF17A69B972B
                                                                                                                                                                                                                          SHA-256:F6B6040B2213FB7022C2D29AFC841D41A7AF291BAA1AE92066171EBE94070C87
                                                                                                                                                                                                                          SHA-512:F7E11F48138FFA996135C1E1D78762E52B4045C0C989FB09A8E6F2C134BE4337F54ABB49015829BDB9E3E041F9CFA2FBD96F0A2993A986627FE042F2EE802DDD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@....... ....@.......................................... ..................H)...........................................................................................rdata..u...........................@..@.rsrc........ ......................@..@.............#pf........Y...........RSDS..^..D<@.. $........C:\vmagent_new\bin\joblist\815457\out\Release\ja\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.968514351588424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:5vHP8qNfXOKM5VHblx1qhvmVqC7exscB3neUvESwTPprqWPQTUDnwENL1c:hHP8KX5M5VHRivmsCescReUsZPqid8
                                                                                                                                                                                                                          MD5:BD29091BA65B3FC08C79654997B4C82B
                                                                                                                                                                                                                          SHA1:3B353EC41DCC96D898715F6474656F13931C1B61
                                                                                                                                                                                                                          SHA-256:A3CFC3C8F95F0ED56306D28AC87408F10875C43BCA7778C6E1CC18C7A3441183
                                                                                                                                                                                                                          SHA-512:AE64DAE0E4025968BFB14E57C2FAAB0C9DA39943DAE9C884CBBD940433B29613C090B98899DB847C94B265F969A6ED3CFEBFF35AF284CA9619E6E25937067650
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................A..a,.@.-_...#.....2..vI...^..2..H"..........yU.;.i[..{.~:p.u.!...&..JnZ.......)px...@-T......7.HK.)...Z...[@n,4..h.C.!....#..w%..w.`...0..$................0...............q.%H...CK.d.d.=\I...).../..UQ.9z..@.(..gc3v.... ..v..+......`f.~.z........o+..}..az............(-z......3.*..7>T8O...._='..P.hX.....Itvz...r~$.....r.3....L.e..H|. z>x!;C..J..a.=..c$.....6..6..._s~..b"-...!.fI.&....w.]b......+....b...U./..m.6[.o.DS...=>..._C8.Av..yy.^*Sh-.s..Z......w\.n.;...q..h..Q.....<..V.........t.....4.6..F..=Q*..........0B..h.ja..=......|..>dz.,.)......&.......3..|..;]"q..A......R.y{.......$.d.L.:.......]j...G./<mFJ.!.,Lc.....Fcvw..{4.SH.*..m..l..|.?`N=d.l....O..y~....u9..?s....Jy..P

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32908
                                                                                                                                                                                                                          Entropy (8bit):7.98579519717503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:mqPy0zBxmlBLCxBIZuPVOWdT0bQUu9d2+8Pc1fCrGrP:m90nmlBLSBjt/T0MUu2ofCrY
                                                                                                                                                                                                                          MD5:F507C8DB8F8EC9361F36608408C9939E
                                                                                                                                                                                                                          SHA1:F3915EDB67FC281DDE5657B383E3A5AEDFE96BB8
                                                                                                                                                                                                                          SHA-256:DAB50E3C2787808BEEB0B377AD7C3DE2C518578B9F7A4EC4AC29063D59C00B3D
                                                                                                                                                                                                                          SHA-512:CB09E4F033B873211BFA8B8B82FA207EA5C176D8D686487C2253214F5F965734D2A16A04AE41B849FFA20B3B03814714274B749F07DBC28A0A5676A86630FEEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................r.e.g.m.o.n...d.a.t..............................................................................................................`1.!.../.C~.}.Q.i.{,..L......B.PG...xJ..L#.......B#.5J?.j}..f..`x.F.dG.p......."...VOn%.%M.D.;.F;.XL].o.S.DK....F[.....]....#..w%..w.`...0..d.6..............0..........X.6./).5.b..V..p,...u}".~..t...0...r..6,...c.....y..>.....lxh.t...O...-}~.c..1.'zv:..s..t^.|....%.."k.c....n.....J..x&. ._.-...\.9>.$.q.).~........v...b..IY.{...cp.f5..F.&..o.].V....0..J....w..f].%...!..\t.s+.J}....7.X..nI.z.M0...5...)x.8\G.._..w@.'..1....?=D.y.:Hw...9.@.Y.9.hd...$h^..I.G..gy..j.......5...nB.4 0!e..N...WQ.k....:x.9.`........3....38...W[..K1..{Q`..5P&z..8.J<.`.'+.i.y..0.a"Zu......KS......M..h...O..qbj..$../Z.M&...;...`..n.>..#.8. .m...|...s.$.K.T*c.....H.Z.S...P..5..#....^[.a=...........V.k..)r..%.i_.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15840
                                                                                                                                                                                                                          Entropy (8bit):7.135786868186291
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:79f7+qgaz6ki2cP0iwfL4hjmS+ShjmM6IGBkSu/TL:hyqp+2cPfwPS+ST6nkL/TL
                                                                                                                                                                                                                          MD5:58EAA38537B909BE84C0EB1A62141B3A
                                                                                                                                                                                                                          SHA1:C9F5A17DC72FBEE27AAB6BB528E1D18D158D9E5F
                                                                                                                                                                                                                          SHA-256:C499BCB93BA3C65B975F2B7E124C3C1733A25D9212BF2A36251FD274D4D9687F
                                                                                                                                                                                                                          SHA-512:E3AC31238D9F90A02510371D67EE27BCE9E67362E9CB46256B65D2227803702D98BF8572DFD3456D8E285DD9E5F85A3698C206C78ECB17E59EA210EA24956D61
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...afrf...........!.........................................................0.......t....@.......................................... ..................H)...........................................................................................rdata..t...........................@..@.rsrc........ ......................@..@............afrf........X...........RSDS0%..ff.C...E........C:\vmagent_new\bin\joblist\815994\out\Release\ja\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1060, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1085440
                                                                                                                                                                                                                          Entropy (8bit):6.84258087250786
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:/MMFm6IT9dXbt23MnjukAj6x8VXBB8B3pJj2ZhL0:w6aNt23gukAjA8V/c
                                                                                                                                                                                                                          MD5:EB0CE0E2336F4345ED8586AD8881D22F
                                                                                                                                                                                                                          SHA1:D0AF75D196E74BEE5F76F5CB417034B02ED8E713
                                                                                                                                                                                                                          SHA-256:AFF146A384C908594085C51199C6F01D318639261B97EEE2B29BEFAE94671DD5
                                                                                                                                                                                                                          SHA-512:81FF693D1C962035595BFCB7F52BF9F8894893B90684963EFD50A615F7168D97095A628208EA4DE6CFFD20B730A068F2999160A3A4F503566E95E3C0BA8788CE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......$.................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 217, database pages 791, cookie 0x8, schema 1, UTF-8, version-valid-for 217
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):809984
                                                                                                                                                                                                                          Entropy (8bit):5.832902414087213
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:g/nCExkRpiJhfKNJhCVdTTOfPd/m9mhNs7/U+n2ul:iCExkRgJhfKNJYHMPJm9mhA/Ue
                                                                                                                                                                                                                          MD5:A149E569E5D88D316A96EC505DF120B5
                                                                                                                                                                                                                          SHA1:ED1C2E6291AFF498C916F07C0091CB9E07F57F15
                                                                                                                                                                                                                          SHA-256:B45E8E4C0EBC858E611DB2026DFBCA0F5BD7DA5BAADCC7FECF61D4B832025ADD
                                                                                                                                                                                                                          SHA-512:09AD73396563A41BA30D022DF8A393CE588C39A0AEA804C13F392CBD959E06243B94262FEB81154748D2B7C4C7F002CC06A56DB9E2C2DBBBF26CAEB5CFC2E264
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.........................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):29816
                                                                                                                                                                                                                          Entropy (8bit):6.17846922140051
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7BYacsultAgwBAP3Excizfb/Dr7BAzK6vifLyLELDWLSx8M8z7eMIs:mt4B23ESYfrDPBAzK6vijYCDWLSxXE
                                                                                                                                                                                                                          MD5:33F98B36F108092766FA2F82506E199C
                                                                                                                                                                                                                          SHA1:BDF4C2CF372880C9B418DF67D2CA7348D06D7FEC
                                                                                                                                                                                                                          SHA-256:8BF14FFC6EE05BB86C05669097FAC69B573D82F97888F8D65C973C9B6BE37525
                                                                                                                                                                                                                          SHA-512:282E06167FBEE25F01E7BB0897ED0232DA7D06FA6AC6540F5CB3B940A22DDC4C3379D1EA320EC1C9F0490C7E6F323B82346EE13B193EC091FA75D4D879DF265F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....KU...........!.........Z............................................................@.......................................... ..HW...........^...............................................................................................rdata..............................@..@.rsrc...HW... ...X..................@..@..............KU........v...........RSDS<:.q5..C.u1..S.....D:\Projects\SafeGuardIntl\branches\SafeInt_V6.2\i18n\I18N\SPTOOL\JA\Release\360SPTool.exe.pdb.......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1698
                                                                                                                                                                                                                          Entropy (8bit):4.956211600533341
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q++uNLF25f5ysAjRs3kFupEkFGMQEkFoHC2FFaYBvaf3RGjfzyWWAf:r+uNLF29ssERqkFuqkFBkFYmpZu7t7
                                                                                                                                                                                                                          MD5:3622D9547F45D52AAECA1500F37410BF
                                                                                                                                                                                                                          SHA1:A9602BE92C9072C1611A71B7DA5706DF8029A89B
                                                                                                                                                                                                                          SHA-256:404A69BD22159DB9374B803E96DC16D753AE08D879C6DBDC31CEE8B2BEA1ACC5
                                                                                                                                                                                                                          SHA-512:673D669FE0D1DBFA87BF3F58DCF893AEFBE2756294F6D89E599D9CA2D1B3CB7165C765CDDC3B800549677E4752FAAB9D8CCD228D963D3CA98C9DEFF8EA93AEA1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=..0.0.0.0.0o0.0.0.0.0.0.0k0.0.0.0.0W0f0D0~0Y0....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=..N.[j0.0.0.0.0.0L0.0.0.0.0w..RW0.0F0h0W0f0D0.0n0.0.i.QW0~0W0_0.0....I.D.S._.T.I.T.L.E._.R.E.D.=..0.0.0n0(g..L0.0.0.0.0w..RW0.0F0h0W0f0D0.0n0.0.i.QW0~0W0_0.0....I.D.S._.N.O.T.E._.B.L.U.E.=..0.0.0.0.0.0.0.0.0.0L0.[K0k0.0.0.0.0w..RW0.0B0j0_0n0.0.0.0.0.0.0.0..M0...0F0h0W0f0D0.0.S..'`L0B0.0~0Y0.0T0..g0.0.0.0.0w..RW0_0n0g0j0Q0.0p0.0.va0k0.b&TY0.0S0h0.0J0.R.0W0~0Y0.0....I.D.S._.N.O.T.E._.O.R.A.N.G.E.=...8^.0.N.[j0.0.0.0.0.0o0.0.0.0.0w..RW0.0B0j0_0n0.0.0.0.0.0.0.0..M0..~0Y0.0.b&TY0.0S0h0.0J0.R.0W0~0Y0.0.0.0.0.0.0.0.0.[.0_0.0.03.6.0.o0.0.0.0;ub..0.NBf\PbkW0~0Y0.0....I.D.S._.N.O.T.E._.R.E.D.=...8^.0.0.0.0n0(g...0.0.0.0.0.0.0.0.0.0.0o0.0.0.0.0w..RW0.0B0j0_0n0.0.0.0.0.0.0.0..M0..~0Y0.0.b&TY0.0S0h0.0J0.R.0W0~0Y0.0.0.0.0.0.0.0.[.0_0.0.03.6.0.o0.0.0.0;ub..0.NBf\PbkW0~0Y0.0....I.D.S._.I.N.F.O._.A.L.L.O.C.=.1..S....I.D.S._.I.N.F.O._.B.L.O.C.K.=.;.bk....I.D.S._.I.N.F.O.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):107520
                                                                                                                                                                                                                          Entropy (8bit):5.403807939014363
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:NORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3T:NOBrUC4jyUJGKzgSg+PZBVlFK
                                                                                                                                                                                                                          MD5:B296CA0196D0B79EB77CAD154385E190
                                                                                                                                                                                                                          SHA1:069706942113BE9D9E9CBEE9CD24C0B145DEB9C6
                                                                                                                                                                                                                          SHA-256:42A7C60FFCB859D8FF0A6CBF90A7F88B2E41D5E166A3BB58E9DAED403F20D377
                                                                                                                                                                                                                          SHA-512:EF3EE75770DAB37B89EDA6A5A8269C4FA05FDC0EF1BB6020A8267E6E08DD6C9BC5735D60CC3551ABF04CA61E8AED981495DF7153313AD9BE173D1CCAC7271030
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........h...................................................... .....@.......................................... ...e...........l..h7...........................................................................................rdata..............................@..@.rsrc....e... ...f..................@..@..............2\........w...........RSDS...3.1hG..J........E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\ja\Release\360procmon.dll.pdb......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):51832
                                                                                                                                                                                                                          Entropy (8bit):6.054880816580705
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:33v+tnPKY4PWWYzpnD9UT1tFGHXjpjqrVk/rfroLovXNu2lZZ3P9PZ9MGx6U2M:QKJSpD9+1tFGHXt+RKre2lLQU2M
                                                                                                                                                                                                                          MD5:72D2BFE57765EEE4B86C9BE50B147C53
                                                                                                                                                                                                                          SHA1:7F94A9783CFA31AF90961060E0DB8A4418D0B5A2
                                                                                                                                                                                                                          SHA-256:C0B8F076377E3C74292D4EC706E95A8A257385BB3EF40602CECB8ADD30B18ED6
                                                                                                                                                                                                                          SHA-512:7FB0FAE32A3133556559ECD5154E04B767ACCCD4CC40DF5C49DBCC0886B61AFFA5836B833D40016F9BD482EA0DC18547F47FA9659B9EF24EB21F369BF8DDDBF6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...z.U.........." .....Z...T.......................................................`....@.....................................................(.......<...........................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc...<...........................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20480
                                                                                                                                                                                                                          Entropy (8bit):7.037391066075695
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7WLiDRWizS8xkK6aLELRI/zoYCsmbn9I70HVJeMWeHl3PQKvrfpMQ3t7L:4iDRWizS8xkK6ACRI/zdCrreQ1IeF3Pf
                                                                                                                                                                                                                          MD5:4BDC0414D62AA99541990D900E051ABC
                                                                                                                                                                                                                          SHA1:F3380C0034DA001B400284F6B8AA9577C0864004
                                                                                                                                                                                                                          SHA-256:08B5F439A95AD7298CD3516B383650497751EFADD7B5A17C5A7FABEA81BAA47B
                                                                                                                                                                                                                          SHA-512:57A29949A17C2D3580BBDAC3A1DBC75B83ED7777C6E3E714739110823C9D26CA18F7B9616DAFEA06E93597B47F74B647ACB55D72B1F5CA79C88A97AEAD950BC9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........................................................0.......#....@.............................................l...............h7...........................................................................................rsrc...l...........................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...............................................................................................................................................................................................................................................(...8...................................................*...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.1415212041496625
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7CcB60OZ+rjGI7nOSeMVr63jlwcoz2DDMQ3Q:OcB60OZ+rjVhSRozkU
                                                                                                                                                                                                                          MD5:7832728C3F513EC4CA8F7FB42FA48260
                                                                                                                                                                                                                          SHA1:290D88776155BAFB71B995AD1AA33A966794EB79
                                                                                                                                                                                                                          SHA-256:1673C02F87ACB7770A7959256989E83C3324CA90B99A38E76DBC07B0A4068379
                                                                                                                                                                                                                          SHA-512:CE632544EB5C13723FB6DB352A1A771B0704DE9285E1472BDBBD7EC1FF06C3C2167A8CF9C9208B0D248F4FC56743C311D854D4FF6AA15648AAF618B019595ADE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0............@.......................................... ..`................7...........................................................................................rdata..}...........................@..@.rsrc...`.... ......................@..@...............[........a...........RSDS.D>..B...s."......C:\vmagent_new\bin\joblist\259671\out\Release\ja\UDiskScanEngine.dll.pdb............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19000
                                                                                                                                                                                                                          Entropy (8bit):7.003498203790837
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7I2len0eR3K+h1MeK6j5DGPhC0DQKvrfpMQ3w:82lend9K0MeKg5DGVQwG
                                                                                                                                                                                                                          MD5:FA2C06D42DFDC85659BD79229F0B6672
                                                                                                                                                                                                                          SHA1:81126C531EE9B5CF3FCE7E44D9E4DED04A0F4174
                                                                                                                                                                                                                          SHA-256:56DB2B7759B0B88D33C6AFA329AFF9689219D745C7C3D4A3A0F2C8D1F711BC68
                                                                                                                                                                                                                          SHA-512:A9F0C043E541927BB01C8494AE56FC77D1186631F8154E7B845CD59853E78F32D2D0AF3AF834027690DAC3D056B5E53B797E1E8D2D38F9B6DB4DFC25A4AE7954
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... ............@..............................................................;...........................................................................................rsrc...............................@..@....................................................................8.......P.......x...................................................................................................`... .......................8.......................P.......................h.......................x...............................................................................................................................,...............8...........T...>...........................H...............................d...Z.............I.D.D._.D.L.G.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):52856
                                                                                                                                                                                                                          Entropy (8bit):6.376784973175148
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:eCG11xWF7Lp/El6Eh7lKlJ01e+6JWQXNu2lZZ3P9PZ9MHWBATx:HGa7l/8h7x4JWZ2lWWBATx
                                                                                                                                                                                                                          MD5:E532FF70A775BE1DC5E7F70FAA4F3997
                                                                                                                                                                                                                          SHA1:FBD608B979DE30A23EFE23939AC4F3C27871B00A
                                                                                                                                                                                                                          SHA-256:65DBC8B5FC6E04924A99FC3EC2B5930913378E5B5D8B922DCBAFAE7D4D5D782F
                                                                                                                                                                                                                          SHA-512:110B2544D967D72E82B067DF4D9475A75482F6CD258D5396CA893A548FE3EA2441A10FDAA90F6E9249C6B112CD510B6A2DD3E6DB54A9A52396C65EFE6D090118
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...8.U...........!.....d...N......B...............................................F.....@.....................................(.......<........................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc...<...........................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8824
                                                                                                                                                                                                                          Entropy (8bit):6.810821675799762
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7NjAiMBKDvyMrj1grjzR+vnr9ZCspE+TMArf0cy8f:7OiYKDKM8z7eMaV
                                                                                                                                                                                                                          MD5:B4825F6AF164A0EB8DF44903A8D481F0
                                                                                                                                                                                                                          SHA1:922C837AE05441CB44EEC4BA7FFAA2220480B033
                                                                                                                                                                                                                          SHA-256:445336A293700C55F948FEF5ACBA873F65BB25A6930DC3D13D750F7B29BDBD32
                                                                                                                                                                                                                          SHA-512:FF6A310EB181EA128616A6DEDB174383EEE174E51046B5763357A104233694D66D7620FAD318A8B5FD68F7CA990463232F1D20A4764B34EC0A54F54352AE44E4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ......g.....@..........................................................................................................................................................rsrc...............................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...............................................$...`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. ..0.0.0.0..M.i.c.r.o.s.o.f.t. .E.d.g.e. .

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8824
                                                                                                                                                                                                                          Entropy (8bit):6.726028285343336
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7wxMDN3yMrj1grjzR+vnr9ZCspE+TMAr/eknNvuB:7QKQM8z7eMwekmB
                                                                                                                                                                                                                          MD5:A71F39F7BAAEC5873A21B62F14E37674
                                                                                                                                                                                                                          SHA1:5E81A3EAF58EE4CFFEA7246F59EE846E1ECED9D5
                                                                                                                                                                                                                          SHA-256:853800FBBC1B946F786F4E32BA3EBA8649869939E89A33DDBE58971CCB9E6164
                                                                                                                                                                                                                          SHA-512:45CA8EEC308726C20AF349906E7D07078B472EBA758ED397D4C5F30CAEDA93C7188BA2BE9814BB3FE3F590B663183BABA80DB03C637F548ECCF9BCF9E1648CE0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... .......l....@..........................................................................................................................................................................rsrc...............................@..@....................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...............................................$...`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. ..0.0.0.0..M.i.c.r.o.s.o.f.t. .E.d.g.e. .

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):374
                                                                                                                                                                                                                          Entropy (8bit):4.212179217835906
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Q++uimVb8cW0GPlpUsjytUFOQR4lGMlS4gEOPPEOPqaot65EOPq10TlSr:Q++ubxi0GQBEhR4LU4gEgE998E910TUr
                                                                                                                                                                                                                          MD5:ECE823C7553E35870022F45BB4DDEEE8
                                                                                                                                                                                                                          SHA1:20FFB1B67DAA0211478C716ED9440926099890A4
                                                                                                                                                                                                                          SHA-256:2C7711889C56F2BF9A1A498FC97E175E337FF21FF496D3F681FFCA8A3A2633EC
                                                                                                                                                                                                                          SHA-512:8356E494D9EAC0D8C8096C441D5172B57805A98ED1C7E700311CF2E1D478196AA59B7C84596A8B33D9E29E1313215952695048C4E26F66B7F9F287A5BE487D1A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=.JRd..n.0....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.U.S.B..0.0.0n0.N.[j0.0.0.0.0....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=.JRd..n.0..\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=.._CQ.n.0....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.U.S.B..0.0.0n0..W0.0.0.0.0....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=.h.:y._CQ.n.0..\.n.%.s.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8452
                                                                                                                                                                                                                          Entropy (8bit):3.595620415381497
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVlyHNqWIajuwapG4J8nX6WSbJ1J9WO6zFWbmc:29+DgRgSzMG4J8nAW3FWT
                                                                                                                                                                                                                          MD5:9F13DFB9C17A660706DFBA96889212B8
                                                                                                                                                                                                                          SHA1:0ECC7670567DF42878261F5E49BF7EB802441A85
                                                                                                                                                                                                                          SHA-256:81769D3DA9178F0002AF204A81F03EE78F09579EEF7C50AB0974B563E6D9A2A4
                                                                                                                                                                                                                          SHA-512:CF6D41BD821743EC6FA7D47FF12FAFC7B23DEEA941CADDB3B3F2C8696B9541D00156C530ED9750477064A8E31DE97DAD77B540AC5EA5729B6D4D76160804D6B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.3390805214857044
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsug6PCabR:r5u5/+mMks5qTp1mNqce9Oo96aabR
                                                                                                                                                                                                                          MD5:12AEB8E96C186EA48F829B5D93B226D7
                                                                                                                                                                                                                          SHA1:108D12F998392B9D6BF0F8EE0C32026B160C7E9C
                                                                                                                                                                                                                          SHA-256:FF625B6678074125E843583002B81DECFF263501FC29D8B8FF2A13E60BC088E3
                                                                                                                                                                                                                          SHA-512:049F310835CFF9C9CEABCC318E686740D0BA3558E45F1F529495F7779DFCD25D551B93EDD24EA33BEB8CA3D99D4FB16B1DCB8F35EE1369E1950016256843C5A0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ja\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.80133175416017
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7h2leJMfss7yMrj6rrjzR+vnr9ZCspE+TMorvG+Rf8:7h2leJM0suMCLz7eMj6U
                                                                                                                                                                                                                          MD5:C16C9C135C401D7FBF5ED6CF95A54D1A
                                                                                                                                                                                                                          SHA1:3750761615C149FA1256CCB3910F8A8DE3F8E43B
                                                                                                                                                                                                                          SHA-256:A63D3270A133E5DEBF22B549AC227E46178540BB1146F7DC5131A1EDABFB4E3E
                                                                                                                                                                                                                          SHA-512:3E10876F002FB5673BB2C727F1CE33909522082233AC094D48BBE58C979B61CD1363E0A959A8B712FD53A313AF85165D321C019FF6B577C4820EAB44F66C008C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....=U...........!......................................................... ............@..........................................................................................................................................................rsrc...............................@..@....................................................................0.......X.......p...................................................................`...........................................................................0.......................@.......................P.......................`.......................p...............................8...............<...............p...........t...................x...........l...Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):129088
                                                                                                                                                                                                                          Entropy (8bit):5.233046956405083
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:ImvblAch7V7RotOM5vOob3v1XbtKvgVUglBBPOh3W1:I67RonUgVUgl+h3W1
                                                                                                                                                                                                                          MD5:3E5C2D008972836FC07E8A49B8BC237F
                                                                                                                                                                                                                          SHA1:93800EEF4F391C97A6EA4BCEE8603DF850F8A02B
                                                                                                                                                                                                                          SHA-256:A03C604691154E436EB21A7EB865C98BAF33B83AF18570A000EA31CE4BA844DF
                                                                                                                                                                                                                          SHA-512:6C6DB8BBE7EAFC2A063C77B8BA7EDA2A2AE87DCC98A997E290462E987EA3CE2872613D589272B823825BFDA87EA83251672FBD30E705289F74E13E0FCF99E3C3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L....H.[...........!.....d...V......B................................................\....@....................................(........................7.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1620
                                                                                                                                                                                                                          Entropy (8bit):3.6031033187099655
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uLTCVpKGkIKNabIfLY4Bw+iDHupA+JY7+YbqcUeBg:r3LTCVkG0BZBw+iDGA+JY7+aqPUg
                                                                                                                                                                                                                          MD5:880E5C62A78E5D11C9510F0A0482CB88
                                                                                                                                                                                                                          SHA1:E3B8B36176063545F3ECE610851C4418BCA6A55A
                                                                                                                                                                                                                          SHA-256:87C1DC55F5CD035C6D880D14158E0DBCD193D69CC331001EC456B5B8DFC1753F
                                                                                                                                                                                                                          SHA-512:30CA326A95A37873DCAB2F15EDF69FD80CB6D35FAC4501B23E3C8593634EABD0851AB33CF23BC16DFBEB83047DB30D9CACF57465AF564DBD97EB37E7ACA181B1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y. .E.r.r.o.r. .R.e.p.o.r.t.....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=.h.a.s. .e.n.c.o.u.n.t.e.r.e.d. .s.e.r.i.o.u.s. .p.r.o.b.l.e.m.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=.W.e.'.r.e. .s.o.r.r.y. .f.o.r. .a.n.y. .i.n.c.o.n.v.e.n.i.e.n.c.e. .c.a.u.s.e.d.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=.T.h.e. .p.r.o.g.r.a.m. .y.o.u.'.r.e. .u.s.i.n.g. .h.a.s. .e.r.r.o.r. .a.n.d. .n.e.e.d.s. .t.o. .b.e. .c.l.o.s.e.d... .W.e. .h.o.p.e. .y.o.u. .c.o.u.l.d. .s.e.n.d. .t.h.e.s.e. .i.n.f.o.r.m.a.t.i.o.n. .t.o. .o.u.r. .w.e.b.s.i.t.e. .t.o. .h.e.l.p. .u.s. .i.m.p.r.o.v.e. .o.u.r. .q.u.a.l.i.t.y... .W.e. .o.n.l.y. .s.e.n.d. .i.n.f.o.r.m.a.t.i.o.n. .w.i.t.h.i.n. .m.e.m.o.r.y. .a.n.d. .i.t. .d.o.e.s.n.'.t. .c.o.n.t.a.i.n. .a.n.y. .p.e.r.s.o.n.a.l. .i.n.f.o.r.m.a.t.i.o.n.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\LibSDI.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):116036
                                                                                                                                                                                                                          Entropy (8bit):7.998317027862222
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:jHUDSlMiffBSae95WGeDZk1FNtQL5HDrL9Qbd:jHUDixp/eLW1MLtWjn98d
                                                                                                                                                                                                                          MD5:552DBF3AF7B5615F2C7F5A0C64E03CA3
                                                                                                                                                                                                                          SHA1:A6773ABC443D8CE49C88C1554BD7A4196189C614
                                                                                                                                                                                                                          SHA-256:F511A0EEA52CB982C60EC2A8758007A8D83F8A36BB4B23B27E320CD9441862F2
                                                                                                                                                                                                                          SHA-512:64FBE41E296EF5D94CD76496623CFA4F49F0BCF1DA4F1A172320B81DC344DC94112D3465FCF1B4DF2166746CEC8484F2D2F1B2D238DC11EB82014B70EE31CE83
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:...=.[....X..'..|!..~.F...7Qp.p.=.8A`'`.|...,........X.....,.%.....9..f-.<t....n..ws.....2.K..LFJ6...wS...-.%.(........}....d t..y..;.kw.......R......L"...4.h...4..F..;.A...}T....q.M.Et.2o&.SPP..O..:.0.........].....w..Ft.A...~.M(, ...`.U'......e...H...W......C...)... %..mq.D.@...sL\;Gi6..%-?...pA.,@..D.'..U..=Aj.....OS..L!&..e5_J.....z..u9).N.4y...#w..#..C.......IF\X.....FP.-..{fdkW)6[!.*.z==_.i....sc...8.<u.../t..g.<p2.f.s.N..Y.w&:.9...J.m-Z.....)..!.........J....(._...Ee..,.G.}e...gu.....T.|......}(..t.._..[....".n.....).#...Ym> ..H....53-....{.^.../8...VO.....S.%.i.......Fe$...Y.Qg)e.;"]=.....T.Ac.w....$....B4.N.~9]\.|...b......Q.D.l(...R...J.`..g.cCJ..1`M(....3n..zng>.UV3..C..S..,.E..E.>.F.R...m@.{..\.ZH..a!j.|o..^.....v.m.#....'...OG..].....2...!....q.[%.B......4[.v.=?..`....0d....(.~.Tc...S.$.....4.......kt.sgvqp8v...........n...|0.......B]...$......&H.P....!.HhZH....(.......F.P.2\.....S.."[A%e.p....0...1.C..a........Wl..S..%..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.601208857207512
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7djtGhAfIGXgaZEpI7nOSeMLujROMov05MQ38:hjtvIGXLESfsROMoZ
                                                                                                                                                                                                                          MD5:15AD59775F51CC2E2A692F975098BDC7
                                                                                                                                                                                                                          SHA1:185526253EEBAC46D551DC2AF328998CFED91416
                                                                                                                                                                                                                          SHA-256:474A8984F7CD7390B41A005563564F80F761162A9A9A395AF68AF5E655E6F31B
                                                                                                                                                                                                                          SHA-512:14680CD39B4D57F64FE36DEA99B9ED4604000A96951A39C802728565D90CB2404B7EDACBF2FA89E468C41A0E9BC5E326E2E064E3492300CF3640A85D91EBC453
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....~[...........!.........................................................@............@.......................................... ..L............ ...7...........................................................................................rdata..y...........................@..@.rsrc...L.... ......................@..@..............~[........]...........RSDS..XC...C..D.c.Z....C:\vmagent_new\bin\joblist\286038\out\Release\pl\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75320
                                                                                                                                                                                                                          Entropy (8bit):4.799089839799452
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:sfdNL5qYfj/wWfZb/XFeoy5yFYECG5lpgATSQPA3MQg+GiK9K0MeKg1DGkCDSQww:sF95xbwYhNX2YiK9weCW
                                                                                                                                                                                                                          MD5:F9953C280CE904CC8F84D658B1F2481E
                                                                                                                                                                                                                          SHA1:6568B698979ADC13B02DB380AC3D54FA3E9C3209
                                                                                                                                                                                                                          SHA-256:B1DE4A0EB8F04F3323B36A9C1D529AD961C2C43E02848CB26434AF327798EC68
                                                                                                                                                                                                                          SHA-512:14190ACA14D122B0DB5F93F56A73A80EAADC00D58C83360984C536803A9B08B885E15DD185C75535CC2B5A37B240CBA30ED719CCFAAF900E524E2828B227D3AA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..x...x...x.......x.......x.......x.......x.......x...y...x.......x.......x.......x.Rich..x.........PE..L......^...........!......................... ............................... .......O....@..................................!..<....@..$................;...... .... ............................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`....0......................@....rsrc...$....@......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67688
                                                                                                                                                                                                                          Entropy (8bit):4.746474657591871
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:2E4ul5xBj/wWfZb/XFeoy5yFYECG51gATSQPA3MQIGduv+Pocc3Q73whrm:tBbwYh3X27dI+wJQ7gha
                                                                                                                                                                                                                          MD5:B101AFDB6A10A8408347207A95EA827A
                                                                                                                                                                                                                          SHA1:BF9CDB457E2C3E6604C35BD93C6D819AC8034D55
                                                                                                                                                                                                                          SHA-256:41FC1D658E3D6795B701495D45E8D7BEF7D8CE770138044B34FBACAD08A617BE
                                                                                                                                                                                                                          SHA-512:CE24418045352557B5D0ED9EC71DB00D016938CD0FC2308E3BA0A61CD40EC0DF3A9B620E55D28724B509BAB3F801B7A88548B0B08B7D868A6046F85A49AAE910
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....)Z...........!.................................................................^....@.............................................T................5...........................................................................................rsrc...T...........................@..@....................................................................0.......8.......X.......p...................~.......x........................................... .......8.......P.......h...............................................................(.......@.......X.......p...............................................................0.......H.......`...................0...x...`.......................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54840
                                                                                                                                                                                                                          Entropy (8bit):5.190787851606403
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:3fdNxalj/wWfZb/XFeoy5yFYECG5nPNU49K0MeKgxDGeQwd:3Fr4bwYh/U49weL
                                                                                                                                                                                                                          MD5:A07470619B7236F8F61729489500F888
                                                                                                                                                                                                                          SHA1:A217606560B2265578D837FDAE4BE0E47B63DD22
                                                                                                                                                                                                                          SHA-256:9BC130CFC8B4B59DD1BE4BF792EB867F7504965841316EB2377DBCACD518CF70
                                                                                                                                                                                                                          SHA-512:681A20103FE40202222367A19F1D2CF1651CF48C97531EBA06B2B04292121BB8FD0DEB85B057475BF13055B47EC81E95889A4E40ED7C3D96A572EAB9DF5872A1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..x...x...x.......x.......x.......x.......x.......x...y...x.......x.......x.......x.Rich..x.........PE..L......^...........!......................... ......................................z.....@..................................!..<....@...................;...... .... ............................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\deepscan\dsconz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19065
                                                                                                                                                                                                                          Entropy (8bit):7.99002844355779
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:384:etAG4SpbwEKYAbje8a66SbGYQoYtIglDTuREcPJlalIAbF3HQylJ9qHGkEw1o:ibSj0SbDQoYZlDT9cPJl2JbF3lJcmkEP
                                                                                                                                                                                                                          MD5:6E3E9BECCB612A017E9DEC64E3045450
                                                                                                                                                                                                                          SHA1:EBA84C445D9884CF95AD82B1D95B91A3070D1499
                                                                                                                                                                                                                          SHA-256:BADBE251C281E99467AEB23674828BF2CECA6213953A35E8401EE0E48A7311B9
                                                                                                                                                                                                                          SHA-512:3C0BBE40BCB87F1610544A24D5D93DCD4524639785BCD9824A1AEB682E9C148F21DB8A7B6282C8D4AAA6CBA155673EBA2BED0691D562ECEBCBB999E346BA2336
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............=J..#.9..K...|A.........L................LLLD..HLLLLLLRLEL.... ..{.....5lG..]jo.{[T....._.... ...B.+C.|..D^..H..R`.I[...BM....9.~.x.N31...pK...U.O..''z...w...XA...P...5X..nP..$.DdP<VdF.`d.V...&....h.y.b]7..P}...~..3..3...[c....1..s...[............j.....P.v...i.H.t......d.4.Q.V.KJ%......q....j+.3...b.i..[.....8...Sdy.....L81Dw5.9.%...9...5..!yk..H.IV...6.q.VW..G.3{&)E..{. ..v|K$.....E.gC@a...<t.....cy.4...~..r.$bH.Y...L...F..gN..O....6p..We..N...r{.9..;=.%..O..%]=..J.Y=#...//U.=>...F......G^........p.........c%.a.I#...G...8..8.or......!....o.S..6...L......1.c..CM.m...R.^.[:.@.0..6.j.v..A..#.&..+-..C...E.}./T...>...F......C..A...<^k.{Q,.2xaU...C%%U..m.....<....D....@.~.p......D...=JJ..q.G@...It...TI...?~.._._%5...L......ns.Y..k.....g..............XW7..CzZ9....ce@..M.....d...H9qB..J.%.......t...(.t.....5.i.2h).jK[.B3.\U.hW...aR.....sN.>..B.I:...n...3.U'.3.2.&......%-...dSM.,.Zx0..G7....myc....l...,.=.;d..f..l..|...!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60403
                                                                                                                                                                                                                          Entropy (8bit):5.392847591907253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:vAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAA:JM4A6UAHRHF4aImg
                                                                                                                                                                                                                          MD5:504461531300EFD4F029C41A83F8DF1D
                                                                                                                                                                                                                          SHA1:2466E76730121D154C913F76941B7F42EE73C7AE
                                                                                                                                                                                                                          SHA-256:4649EEDC3BAFD98C562D4D1710F44DE19E8E93E3638BC1566E1DA63D90CB04AD
                                                                                                                                                                                                                          SHA-512:F7DD16173120DBFE2DABEAB0C171D7D5868FD3107F13C2967183582FD23FD96C7EECA8107463A4084AD9F8560CD6447C35DC18B331FD3F748521518AC8E46632
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<.......................................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25152
                                                                                                                                                                                                                          Entropy (8bit):6.326201527087637
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7syVo1VK5ysI76eR3KJ1M81rDGPhCMov05MQ3d:nVAK5yTb9KvMcrDGroY
                                                                                                                                                                                                                          MD5:CD37F1DBEEF509B8B716794A8381B4F3
                                                                                                                                                                                                                          SHA1:3C343B99EC5AF396F3127D1C9D55FD5CFA099DCF
                                                                                                                                                                                                                          SHA-256:4D1A978E09C6DAFDCF8D1D315191A9FB8C0D2695E75C7B8650817D027008D1C1
                                                                                                                                                                                                                          SHA-512:178B73ED00BFD8241CC9191DBDD631AE28B5C7E76661863B326EFDE2DC2CB438716C0B70896EE313436CCD90F61DB5226A3484169176F5A4B79EAD1FB4451419
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........&...............................................P............@.......................................... ..x#...........*...7...........................................................................................rdata..y...........................@..@.rsrc...x#... ...$..................@..@............. ._........]...........RSDS2.O5m.{F..........C:\vmagent_new\bin\joblist\503376\out\Release\en\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49272
                                                                                                                                                                                                                          Entropy (8bit):6.359306772453438
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:5y2lF/WFLLpAEl6Zh7laV5tX01StY+6JWgdvmBV2M3:A2kLlARh7vPJWgdvmBV2m
                                                                                                                                                                                                                          MD5:3E88C42C6E9FA317102C1F875F73D549
                                                                                                                                                                                                                          SHA1:156820D9F3BF6B24C7D24330EB6EF73FE33C7F72
                                                                                                                                                                                                                          SHA-256:7E885136A20C3AB48CDEAD810381DCCB10761336A62908CE78FE7F7D397CDE0E
                                                                                                                                                                                                                          SHA-512:58341734FB0CF666DFE9032A52674A645306A93430EBB2C6E5AD987E66CE19C8A91F3FEEBF9BBA54B981D62127613DEC3C939EF4168054D124B855A511B6D59C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...a.U...........!.....d...@......B.....................................................@....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):47736
                                                                                                                                                                                                                          Entropy (8bit):6.053954085108329
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:VXHGdBPASgYoH6dzSnq5TmtzG3TpMtaTV2J8lAovrtd1tnQr:0ASgRcSqNmtzG39Mk5NAOrtLtna
                                                                                                                                                                                                                          MD5:DC4A1C5B62580028A908F63D712C4A99
                                                                                                                                                                                                                          SHA1:5856C971AD3FEBE92DF52DB7AADAAD1438994671
                                                                                                                                                                                                                          SHA-256:EE05002E64E561777EA43AC5B9857141DABB7C9EED007A0D57C30924F61AF91E
                                                                                                                                                                                                                          SHA-512:45DA43AC5B0321DDC5EC599818287BD87B7B6822C8DD6D790B5BBF1232000092AFA695774CD3D9C787919AD02CA9846F7200970E273A99BFBE2AA6BEBFE7E8ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...S.U.........." .....Z...D......................................................^.....@.................................................`...(...................................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20448
                                                                                                                                                                                                                          Entropy (8bit):6.434428355428392
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7dIRqwp/JNxmSRxyE5nIUb6ki2cP0iwfLBKyS+ShjmM6IGBkSEOV:e7yE5922cPfwnS+ST6nk3a
                                                                                                                                                                                                                          MD5:F584EFD5356E4A1BE69209A6A90F8DCA
                                                                                                                                                                                                                          SHA1:6AF86C8FA9C4EA0F28ECA735ACAD675CB32B7EC5
                                                                                                                                                                                                                          SHA-256:CDE2A0834CB8B6E4FABDA07F611567A392B2E4DC23F2FC7921F8B13E774DA940
                                                                                                                                                                                                                          SHA-512:97C02D900A05DBB2F5BA7CD33F53D4B5C67655D0DD11D6B1C374867570DD7CD5114DEB138DB277480FB45E608CCCF7542D76C4CCE7FB5C98356A5105B309BEBA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!........."...............................................@............@.......................................... ..t............&..H)...........................................................................................rdata..r...........................@..@.rsrc...t.... ... ..................@..@.............#pf........V...........RSDSy.~.6L.F.g."k.Z.....C:\vmagent_new\bin\joblist\815456\out\Release\en\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\appmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):31292
                                                                                                                                                                                                                          Entropy (8bit):7.98697494864025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:drQ8ffdzS2KN1gQxCFeWTuIoR7HBssluEqd8Knq:e24N6QckWT1O4q
                                                                                                                                                                                                                          MD5:DDDA5BE2E45D1C5229CD561A03825908
                                                                                                                                                                                                                          SHA1:D9207564DC229C9A05D9A7BAF8C7E2D17C62072B
                                                                                                                                                                                                                          SHA-256:C308EE41E48CC498C396A2CCBC57B7D29D058DD145F9867887544CB74112D63F
                                                                                                                                                                                                                          SHA-512:B16A67086A9D435CA17E35C7EFFDB639CF934A8671CF9F99F4E8F6846AD7E71BE71AED3BDE77A63F3189C155391EFE5287589CF6332DC8BE02E52C90C924EFB3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5.................................................................................................................a.p.p.m.o.n...d.a.t...............................................................................................................q.W.cNA6'!`;..#..[\.t.....7....{..s.....|B....H.r.%..]..b2r.K.P....7]4=....1.$9..~...(..V'Y.;...L....-...O...E.d.T.F..C).....#..w%..w.`...0....C..............0............C.F..*:...3G.!T...O.Dlo,'Q.....\S..3....c......ETN.<..#~..+>o...'L.Q.L..#.(....F.[.>.s-=?.=.u...H.b...L.\na=0'..h....Yy..H,...{..JJ...C..L......,.3..wO@K..&.Q\...5..cY&..2..).2.>.2`@VQ..UO.,d.i.F..@..;...b-<."..6:...g....i.<..0(GX...:...9.L<$."D..{.....`...=a.P..E.l... /..U<J~A.^F5sp.s.U-..Gf.R...=....'..%.>.ki..$\...N...>...A.Y...8.h.e...4...Zy._175.&.6..Ih.8.0L.=.cPD*.U...Uz..T..a'..k.po..;B....6.'.Z.'[=Z.,8.....3l[..^i.Q.-\S._{...Z..5.7....K+XD....Q.V..p......w-.9.(../.....0....,..Z...G0....ae...<.U.\.52x.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19424
                                                                                                                                                                                                                          Entropy (8bit):6.5527302391659905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:78I3ZhT+9lexj6sLU6ki2cP0iwfLaAS+ShjmM6IGBkSN:w7Gxj6af2cPfwJS+ST6nki
                                                                                                                                                                                                                          MD5:507A7B4E028D292BE4EDEDB6B3667E68
                                                                                                                                                                                                                          SHA1:752121FC2F4C4814A4C50BD6964C6237FBC69CD9
                                                                                                                                                                                                                          SHA-256:3EBFED2B2A10B33AF330AFF197905437EF3970E8C944B7970C097AC0CBB99671
                                                                                                                                                                                                                          SHA-512:0B1FB10521512426C448A85976AFE9E2E9C356768A5D2E941DE022C2194A487055C3C724C08DD4ABF1D115F24F80248CCD90A3655544DC17491F0373C603CFB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@............@.......................................... ..P............"..H)...........................................................................................rdata..u...........................@..@.rsrc...P.... ......................@..@.............#pf........Y...........RSDS.o...LF. a:.T......C:\vmagent_new\bin\joblist\815457\out\Release\en\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.968514351588424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:5vHP8qNfXOKM5VHblx1qhvmVqC7exscB3neUvESwTPprqWPQTUDnwENL1c:hHP8KX5M5VHRivmsCescReUsZPqid8
                                                                                                                                                                                                                          MD5:BD29091BA65B3FC08C79654997B4C82B
                                                                                                                                                                                                                          SHA1:3B353EC41DCC96D898715F6474656F13931C1B61
                                                                                                                                                                                                                          SHA-256:A3CFC3C8F95F0ED56306D28AC87408F10875C43BCA7778C6E1CC18C7A3441183
                                                                                                                                                                                                                          SHA-512:AE64DAE0E4025968BFB14E57C2FAAB0C9DA39943DAE9C884CBBD940433B29613C090B98899DB847C94B265F969A6ED3CFEBFF35AF284CA9619E6E25937067650
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................A..a,.@.-_...#.....2..vI...^..2..H"..........yU.;.i[..{.~:p.u.!...&..JnZ.......)px...@-T......7.HK.)...Z...[@n,4..h.C.!....#..w%..w.`...0..$................0...............q.%H...CK.d.d.=\I...).../..UQ.9z..@.(..gc3v.... ..v..+......`f.~.z........o+..}..az............(-z......3.*..7>T8O...._='..P.hX.....Itvz...r~$.....r.3....L.e..H|. z>x!;C..J..a.=..c$.....6..6..._s~..b"-...!.fI.&....w.]b......+....b...U./..m.6[.o.DS...=>..._C8.Av..yy.^*Sh-.s..Z......w\.n.;...q..h..Q.....<..V.........t.....4.6..F..=Q*..........0B..h.ja..=......|..>dz.,.)......&.......3..|..;]"q..A......R.y{.......$.d.L.:.......]j...G./<mFJ.!.,Lc.....Fcvw..{4.SH.*..m..l..|.?`N=d.l....O..y~....u9..?s....Jy..P

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32908
                                                                                                                                                                                                                          Entropy (8bit):7.98579519717503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:mqPy0zBxmlBLCxBIZuPVOWdT0bQUu9d2+8Pc1fCrGrP:m90nmlBLSBjt/T0MUu2ofCrY
                                                                                                                                                                                                                          MD5:F507C8DB8F8EC9361F36608408C9939E
                                                                                                                                                                                                                          SHA1:F3915EDB67FC281DDE5657B383E3A5AEDFE96BB8
                                                                                                                                                                                                                          SHA-256:DAB50E3C2787808BEEB0B377AD7C3DE2C518578B9F7A4EC4AC29063D59C00B3D
                                                                                                                                                                                                                          SHA-512:CB09E4F033B873211BFA8B8B82FA207EA5C176D8D686487C2253214F5F965734D2A16A04AE41B849FFA20B3B03814714274B749F07DBC28A0A5676A86630FEEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................r.e.g.m.o.n...d.a.t..............................................................................................................`1.!.../.C~.}.Q.i.{,..L......B.PG...xJ..L#.......B#.5J?.j}..f..`x.F.dG.p......."...VOn%.%M.D.;.F;.XL].o.S.DK....F[.....]....#..w%..w.`...0..d.6..............0..........X.6./).5.b..V..p,...u}".~..t...0...r..6,...c.....y..>.....lxh.t...O...-}~.c..1.'zv:..s..t^.|....%.."k.c....n.....J..x&. ._.-...\.9>.$.q.).~........v...b..IY.{...cp.f5..F.&..o.].V....0..J....w..f].%...!..\t.s+.J}....7.X..nI.z.M0...5...)x.8\G.._..w@.'..1....?=D.y.:Hw...9.@.Y.9.hd...$h^..I.G..gy..j.......5...nB.4 0!e..N...WQ.k....:x.9.`........3....38...W[..K1..{Q`..5P&z..8.J<.`.'+.i.y..0.a"Zu......KS......M..h...O..qbj..$../Z.M&...;...`..n.>..#.8. .m...|...s.$.K.T*c.....H.Z.S...P..5..#....^[.a=...........V.k..)r..%.i_.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):6.818502996360454
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7p82Phneq2+m06ki2cP0iwfL46SIS+ShjmM6IGBkSvA:c+m/2cPfwHXS+ST6nkz
                                                                                                                                                                                                                          MD5:4F7FEBE3F590F61FBA281D6D48063AEC
                                                                                                                                                                                                                          SHA1:2A978CF218EE950728452E62A7E274F0F7B0F346
                                                                                                                                                                                                                          SHA-256:285B8717038589756ED43BBEFEC8D010FDFDA1B9726606332C1E3601CF6E43FF
                                                                                                                                                                                                                          SHA-512:55193636F87924A75E2EEECBCE50B19E7D1320698CDC58FEF62DCE807C0D462429D6A3034C2EB9E297012E67ADFB236DB91D05EDC4E3514A33017CD379AC3E15
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...cfrf...........!.........................................................@............@.......................................... ..................H)...........................................................................................rdata..t...........................@..@.rsrc........ ......................@..@............cfrf........X...........RSDS8Be.RAIL.Bmd...a....C:\vmagent_new\bin\joblist\815994\out\Release\en\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1059, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1084416
                                                                                                                                                                                                                          Entropy (8bit):6.837064845593466
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:LMMmJ6pODUATD23jo3sANYM9TWLrB8B3phpc0hbB:86EHD23asANYUTW5q
                                                                                                                                                                                                                          MD5:DDE9F4E1FD3C706361CDE23239BAF8E6
                                                                                                                                                                                                                          SHA1:646F69DEC3656FD19579606789D258FEF5A45E96
                                                                                                                                                                                                                          SHA-256:3D1B69B19A8510D6176CEB011B71D79859C13D4C61541EC7174F344D3A77BB24
                                                                                                                                                                                                                          SHA-512:536BAF039072C6E6FD1ECBECE3291C9B1C5EC01D8E41837BF285CF59015B1212A3283FE85B5D52D7A4BC16BADE883B6CCA3A94CE40788159A6545A6880CE7609
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......#.................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007009, page size 1024, file counter 221, database pages 790, cookie 0x8, schema 1, UTF-8, version-valid-for 221
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):808960
                                                                                                                                                                                                                          Entropy (8bit):5.825479215491082
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:c/nCExkRpiJhfKNJhhD5PpS1t/PUTmuisxaA8F5f7:mCExkRgJhfKNJLhctnUTmuTaAQ
                                                                                                                                                                                                                          MD5:E799B79B1FE826868265DCE4C8A6AC28
                                                                                                                                                                                                                          SHA1:44AF1A3FE155B4AC2DA06371A351D056441F409A
                                                                                                                                                                                                                          SHA-256:E00A185464266FDD988EDB2F4BD130B4EBDCE7E064FEDB45806F577F1BB19291
                                                                                                                                                                                                                          SHA-512:B740EB8C8B4A0B1D5D09DA0B3E4D65AB2611BFA83CC97A8B38E419FB9AE975E974738FBF4FB73406C8B3E473D2C092C46126AA6D9AA1525BAF41D632D5AE3E77
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.!.......................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32584
                                                                                                                                                                                                                          Entropy (8bit):6.027932340454107
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7baacsultAgwBAP3Excizfb5pei1QcMCPHz7eMKw8n:at4B23ESYf1Mi1+Hn
                                                                                                                                                                                                                          MD5:9259B466481A1AD9FEED18F6564A210B
                                                                                                                                                                                                                          SHA1:CEAAA84DAEAB6B488AAD65112E0C07B58AB21C4C
                                                                                                                                                                                                                          SHA-256:15164D3600ABD6B8F36AC9F686E965CFB2868025A01CDED4F7707B1AE5008964
                                                                                                                                                                                                                          SHA-512:B7B06367BA9AA0C52AC5CFC49D66E220232D5482B085287C43DE2EF8131F5EE703FFEB4D7BEF0E5D9A430C0146BB2AB69C36174982184A0C06E6BEDA14E808B5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....k.S...........!.........`...........................................................@.......................................... ...\...........d...............................................................................................rdata..q...........................@..@.rsrc....\... ...^..................@..@.............k.S........U...........RSDS,].s...N..bz........C:\SVN\Safe4.0\i18n\I18N\SPTOOL\EN\Release\360SPTool.exe.pdb........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1946
                                                                                                                                                                                                                          Entropy (8bit):3.654774055909802
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q++uNjBuam/xJWjYJWjqLJWHIUR2L+m/xJWjPxm4YNIJWj5CW/qDtxJWwovMkWK+:r+uNjEN5GatnnV/qJ/DgG8iII
                                                                                                                                                                                                                          MD5:849786FD617CBE52AB01A0C9BAE31CCB
                                                                                                                                                                                                                          SHA1:F4545C1B08F43EEFD68075B1C62829C56D70EC47
                                                                                                                                                                                                                          SHA-256:398AB517462332A379AA52F7C11A506011535F5DB0508A213C671416E5AC8615
                                                                                                                                                                                                                          SHA-512:0E1CB94E20126CA5B3911CFE8D91B1512ACF0A77A80FD766E76AA0ED71FF64331BCD1FAF7E085C976F688CD5EC92793839A663750BB5FCFB342563CC47AB901A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=.P.r.o.g.r.a.m. .u.z.y.s.k.u.j.e. .d.o.s.t...p. .d.o. .T.w.o.j.e.j. .k.a.m.e.r.y. .i.n.t.e.r.n.e.t.o.w.e.j.....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=.A. .s.u.s.p.i.c.i.o.u.s. .p.r.o.g.r.a.m. .a.c.c.e.s.s.i.n.g. .y.o.u.r. .w.e.b.c.a.m.....I.D.S._.T.I.T.L.E._.R.E.D.=.D.e.t.e.c.t.e.d. .a. .T.r.o.j.a.n. .a.c.c.e.s.s.i.n.g. .y.o.u.r. .w.e.b.c.a.m.....I.D.S._.N.O.T.E._.B.L.U.E.=.I.f. .y.o.u. .d.i.d. .n.o.t. .i.n.i.t.i.a.t.e. .t.h.e. .a.c.c.e.s.s. .o.f. .y.o.u.r. .w.e.b.c.a.m.,. .i.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.o. .b.l.o.c.k. .i.t.......I.D.S._.N.O.T.E._.O.R.A.N.G.E.=.D.e.t.e.c.t.e.d. .a.n.d. .i.n.t.e.r.c.e.p.t.e.d. .t.h.e. .s.u.s.p.i.c.i.o.u.s. .p.r.o.g.r.a.m. .a.c.c.e.s.s.i.n.g. .y.o.u.r. .w.e.b.c.a.m.......I.D.S._.N.O.T.E._.R.E.D.=.D.e.t.e.c.t.e.d. .a.n.d. .i.n.t.e.r.c.e.p.t.e.d. .T.r.o.j.a.n.s.,. .v.i.r.u.s.e.s. .a.n.d. .m.a.l.i.c.i.o.u.s. .p.r.o.g.r.a.m.s. .a.c.c.e.s.s.i.n.g. .y.o.u.r. .w.e.b.c.a.m.......I.D.S._.I.N.F.O._.A.L.L.O.C.=.A.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):108544
                                                                                                                                                                                                                          Entropy (8bit):5.334911052722087
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:PORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3e:POBrUC4jyUJGKzgSg+Yco46Fe
                                                                                                                                                                                                                          MD5:7BDAC7623FB140E69D7A572859A06457
                                                                                                                                                                                                                          SHA1:E094B2FE3418D43179A475E948A4712B63DEC75B
                                                                                                                                                                                                                          SHA-256:51475F2FA4CF26DFC0B6B27A42B324A109F95F33156618172544DB97CBF4DDDD
                                                                                                                                                                                                                          SHA-512:FBED994A360ECFF425728B1A465C14FFE056C9B227C2EB33F221E0614984FD21670EDDB3681C20E31234A57BFE26BCF02C6A3B5E335D18610D09B4ED14AA5FB2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........l......................................................z.....@.......................................... ...i...........p..h7...........................................................................................rdata..............................@..@.rsrc....i... ...j..................@..@..............2\........w...........RSDS.).s.rCL..vwZ./B....E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\en\Release\360procmon.dll.pdb......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):53368
                                                                                                                                                                                                                          Entropy (8bit):5.901434301235028
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:O3v+tnPKY4PWWYzpnD9UT1tFGHXjpjqdV9/rfroLoZeNMXN+6Ampc:9KJSpD9+1tFGHXt+PtrgINVni
                                                                                                                                                                                                                          MD5:A891BBA335EBD828FF40942007FEF970
                                                                                                                                                                                                                          SHA1:39350B39B74E3884F5D1A64F1C747936AD053D57
                                                                                                                                                                                                                          SHA-256:129A7BA4915D44A475ED953D62627726B9AA4048FFCC316C47F7F533B68AF58B
                                                                                                                                                                                                                          SHA-512:91D1B04D550EDA698B92D64F222EC59C29B5842115B3C3F1159313B620975BC8475B27151C23F21A78F60ABD6C7FA9CE5CB1EA45F9349942338F9BF0C8CFC99F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...|.U.........." .....Z...Z.......................................................G....@.....................................................(...................................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):6.704024547095587
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7PEyLnAYEFPrQP8tVku+pdhh2eryHU8/7X8r9ZCspE+TM4rSEZsBHUckAwmTcViv:7iYsPVI70HVJeM3Hl7VLQKvrfpMQ3vmc
                                                                                                                                                                                                                          MD5:9D8DB959FF46A655A3CD9CCADA611926
                                                                                                                                                                                                                          SHA1:99324FDC3E26E58E4F89C1C517BF3C3D3EC308E9
                                                                                                                                                                                                                          SHA-256:A71E57CAFB118F29740CD80527B094813798E880DE682ECA33BFE97AAA20B509
                                                                                                                                                                                                                          SHA-512:9A2F2D88968470B49D9D13569263050B463570C3CCE1B9821909E910A8A358E64AD428B86095A18F596D2B3ED77E0E21D40F9C24543E4A0872E6B35C5103BEDE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........................................................0.......t....@.............................................................h7...........................................................................................rsrc...............................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...............................................................................................................................................................................................................................................(...8................................................ ..D...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.11751284678224
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7v4B600ZdPYeBsI7nOSeM3bjhEoz2DDMQ37s:b4B600ZBYwTrv+ozk/s
                                                                                                                                                                                                                          MD5:045E32511A0E333477FFC2361C3B589B
                                                                                                                                                                                                                          SHA1:47EEACAA6381BA81E90A78DCF67C327B9F17814F
                                                                                                                                                                                                                          SHA-256:649CA00BA71A5F725CE94BAAA4996A8C202103B1821A3529E84C20A8D882D35F
                                                                                                                                                                                                                          SHA-512:3693769973D463664D5486A22EC42D8EA722ABD3998AB5C6DEC4A7656411BC90FA3B58A0C01E5117840C2E8025AD2AD9F81BC86B58635EF22CC267BB3781624E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0...........@.......................................... ...................7...........................................................................................rdata..}...........................@..@.rsrc........ ......................@..@...............[........a...........RSDS.7.?be.N.l.[........C:\vmagent_new\bin\joblist\259671\out\Release\en\UDiskScanEngine.dll.pdb............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19512
                                                                                                                                                                                                                          Entropy (8bit):6.981125005886438
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7gRsVeR3K+h1MeK6jhDGPhCaoQKvrfpMQ32h:Eu49K0MeKghDGroQwAh
                                                                                                                                                                                                                          MD5:1252D333D67BDE2626596A3E3DA27C1E
                                                                                                                                                                                                                          SHA1:24F44C6CBDA7063BF75467059E4326686E831D2E
                                                                                                                                                                                                                          SHA-256:E7313A001C9FC17AF97C817C13468C1FF8319AB7A51A7168077751A7A110E9D4
                                                                                                                                                                                                                          SHA-512:AE9E671344E840D008CD20CD61AEE1CDF64F12BFD9DEFA8ABB5249CE77F865AE96C87D7EE24A038A22EA218CF404753D2A9A360635B94A1FBFFA816DA94BFD38
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... ......D.....@..............................................................;...........................................................................................rsrc...............................@..@....................................................................8.......P.......x...................................................................................................`... .......................8.......................P.......................h.......................x...............................................................................................................................,...............8...........T...............................................$...................Z.............I.D.D._.D.L.G.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54392
                                                                                                                                                                                                                          Entropy (8bit):6.2287339496325265
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:fCG11xWF7Lp/El6Eh7lKlI019+6JWaeNMXXbBA0bg:KGa7l/8h7I7JWpIXbBA0bg
                                                                                                                                                                                                                          MD5:770107232CB5200DF2CF58CF278AA424
                                                                                                                                                                                                                          SHA1:2340135EEF24D2D1C88F8AC2D9A2C2F5519FCB86
                                                                                                                                                                                                                          SHA-256:110914328D4BF85058EFA99DB13BFEC2C73E3B175B91DFD6B41C6FA72EBAA103
                                                                                                                                                                                                                          SHA-512:0F8B98DED900D9421EB90CFFD527D8218B14354D90B172D592C4945C482191D5E512F2678217C6214ADDB38DA0B9BB9287F84963A50447CF232962BD99B0C3E8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...;.U...........!.....d...T......B...............................................:.....@.....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc...............................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.7828295966719985
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7LyM4ZuyMrj1grjzR+vnr9ZCspE+TMAr3o7hu:7eVzM8z7eM97hu
                                                                                                                                                                                                                          MD5:22A6711F3196AE889C93BD3BA9AD25A9
                                                                                                                                                                                                                          SHA1:90C701D24F9426F551FD3E93988C4A55A1AF92C4
                                                                                                                                                                                                                          SHA-256:61C130D1436EFBA0A4975BC3F1C5F9FDF094A097D8182119193B44150344940E
                                                                                                                                                                                                                          SHA-512:33DB4F9474DF53CE434F6E22F6883DA100473D1B819984171356EEEF523BA534C4ABAF2536596B8758358E755E5D9F3793D85BE12D2D8D5284FC7D13F6C005CD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ............@.............................................H............................................................................................................rsrc...H...........................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .b.r.o.w.s.e.r...M.i.c.r.o.s.o.f.t. .E.d.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.700779948402696
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7VCMqB8x3yMrj1grjzR+vnr9ZCspE+TMAruNNNQkG:7cXyCM8z7eMlVG
                                                                                                                                                                                                                          MD5:5823E8466B97939F4E883A1C6BC7153A
                                                                                                                                                                                                                          SHA1:EB39E7C0134D4E58A3C5B437F493C70EAE5EC284
                                                                                                                                                                                                                          SHA-256:9327E539134100AA8F61947DA7415750F131C4E03BBB7EDB61B0FAB53EA34075
                                                                                                                                                                                                                          SHA-512:E4EA824314151115592B3B2AD8CD423DC2A7183292AA165F74F8E35DA4F142D84D296D34506F503D448C7BD423BE6BF04DA2412B7DAF474FBF4EF6A2AF142BFC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... ......|.....@.............................................................H............................................................................................................rsrc...H...........................@..@....................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .b.r.o.w.s.e.r...M.i.c.r.o.s.o.f.t. .E.d.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):444
                                                                                                                                                                                                                          Entropy (8bit):3.6801510639008024
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Q++uimVb8Fc0g0GPlpUsT4YlgDOQR4lvxXgEOPU70gEOPqaUf0gEOPqgTBf7:Q++ubxeo0GQYn+hR4VxgEbE9LDE9Qf7
                                                                                                                                                                                                                          MD5:2E58B2B687DB6FB6CDDD3BDF2A875FFA
                                                                                                                                                                                                                          SHA1:F4D700DE450BDE53877B824A1021DFD9B52F045A
                                                                                                                                                                                                                          SHA-256:254161D567ED1AE96756809932715790F4BCC5851EBA123BFA6942B2B2D1EB1F
                                                                                                                                                                                                                          SHA-512:258F10FB5F61AD672EDBF2D719E365E1DADD3854F8AE8ABF4005B70324DDCC9CF2C5AA9156BBD9204326D72BDC1B203D2CAF06970B177964FE248C2D90859154
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=.C.l.e.a.n.e.d.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.S.u.s.p.i.c.i.o.u.s. .f.i.l.e.s. .o.f. .U.-.d.i.s.k.....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=.C.l.e.a.n.e.d.:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=.R.e.c.o.v.e.r.....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.U.S.B. .d.r.i.v.e. .h.i.d.d.e.n. .f.o.l.d.e.r.....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=.R.e.c.o.v.e.r.e.d. .a.s.:.\.n.%.s.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8500
                                                                                                                                                                                                                          Entropy (8bit):3.557951484666829
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVl5ENqWIajuwapG4i8nc6WSbJ1J9Wd6AFWbmc:29+DgRgizMG4i8nxWHFWT
                                                                                                                                                                                                                          MD5:47383C910BEFF66E8AEF8A596359E068
                                                                                                                                                                                                                          SHA1:8EE1D273ECA30E3FA84B8A39837E3A396D1B8289
                                                                                                                                                                                                                          SHA-256:B0A2DD51D75609B452A16FB26138FB95545212EB6EFA274F2751EB74CCC5633F
                                                                                                                                                                                                                          SHA-512:3D307569452EC6D80056A3A2E0225D559606DEAB9A6C3913C1FEF7ED6ACA476D7A00190B1BBFA3D032411C2F52427F3096FCE7B7952479AD9B75AA3CEF59D7B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.3362679242046562
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsKVg6PCabR:r5u5/+mMks5qTp1mNqce9Oo16aabR
                                                                                                                                                                                                                          MD5:3997A6ACD6764B3940C593B45BB45120
                                                                                                                                                                                                                          SHA1:16BD731772FEF240EC000C38602C8FCC1B90DFF7
                                                                                                                                                                                                                          SHA-256:A7883C05518F9D1D2AF9773F19F470B25EA94A865FB4D43B9E16518C3434424B
                                                                                                                                                                                                                          SHA-512:FCDC2F450F2771174A71ACB49663F2DE8CD02EB131C1A95DC83ED59D0DCBE676129E960D3FDE5D1CBD9D45FF3F7299028827C8806D867FB51925E41A2C24A2D7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pl\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10568
                                                                                                                                                                                                                          Entropy (8bit):6.811594221456347
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7jp0kvNyMrj6Pu7CrjzR+vnr9ZCspE+TMorCxu:7jpJMMCPHz7eMtu
                                                                                                                                                                                                                          MD5:5EFD82B0E517230C5FCBBB4F02936ED0
                                                                                                                                                                                                                          SHA1:9F3EA7C0778FEDF87A6ED5345E6F45FB1BD173FB
                                                                                                                                                                                                                          SHA-256:09D58A2F0656A777A66288AC4068AA94A2D58D0534328862B8371709EAB2003B
                                                                                                                                                                                                                          SHA-512:12775C718F24DAA20EC8E4F3BDEDE4199C478900B12ADDCB068AE7B20806850FDC903E01C82E6B54E94363725DCFF343AEAC39C3512F5EA58D1BA8D46712AD33
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......S...........!......................................................... .......0....@.............................................d............................................................................................................rsrc...d...........................@..@....................................................................(.......P.......h.......................................................................................................................................................................................(.......................8...H...8...............................................x...............Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.f.o.x.,.I.n.t.e.r.c.e.p.t.e.d. .%.s. .v.i.s.i.t.i.n.g. .%.s. .[.H.a.r.m.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\Antiadwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):138304
                                                                                                                                                                                                                          Entropy (8bit):5.136405227524744
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:5mvblAch7UzRoMlRELutEB2UTzEkVMx0Vz2z5jgBPOXA:5LzRojxY0Vz2z5j7XA
                                                                                                                                                                                                                          MD5:4C0551DA2A0D18A3C9B7F7A2833ECF10
                                                                                                                                                                                                                          SHA1:D96B4139F0814FE4733AAB583D14F27A0BD2C8CA
                                                                                                                                                                                                                          SHA-256:272612EF005C8A830B1DFDD435B1DD280EDA7BF52F8A792FE6E1E4F2B0280381
                                                                                                                                                                                                                          SHA-512:61E918CB138A0BCBDCE76B94749C71314BBCE7FDBB1C1C1F1C9586D51880B3FA6543CE992A19B58C3D4081FC1CA7BA54D3B695E1100B6E655BBAC0BAA7EC28E8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L...a..[...........!.....d...z......B........................................ ............@....................................(.......DA...............7.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc...DA.......B..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1690
                                                                                                                                                                                                                          Entropy (8bit):3.634295521783768
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uL4wVOQ5YiZZDerZyV70rfc+ENSY7QDkq4ee6NYIb:r3L4wVOUYatt7Ofc+ENSY7kkq9X/b
                                                                                                                                                                                                                          MD5:9272EA15B7A7E96843D6D82E41C6E3A5
                                                                                                                                                                                                                          SHA1:2EC803636AEFE5D7BECBF59C9DE0066B68646413
                                                                                                                                                                                                                          SHA-256:078FDCCCCBA1E0D875B58AA1696164AE94E9E476882639D6F7B7EA6AA187D382
                                                                                                                                                                                                                          SHA-512:3462EF91558DBACDB686F77917A072287684046FF2B65438823305ED1C180BCC9DCDA78A4BBAE64B944C9DB01FABADB325AA047D26AA900810496603B658BD75
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.R.e.l.a.t...r.i.o. .d.e. .E.r.r.o.s. .3.6.0. .T.o.t.a.l. .s.e.c.u.r.i.t.y.....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=.e.n.c.o.n.t.r.o.u. .u.m. .p.r.o.b.l.e.m.a. .s...r.i.o.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=.D.e.s.c.u.l.p.e.-.n.o.s. .p.o.r. .q.u.a.l.q.u.e.r. .i.n.c...m.o.d.o. .c.a.u.s.a.d.o.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=.O. .p.r.o.g.r.a.m.a. .q.u.e. .e.s.t... .u.s.a.n.d.o. .p.o.s.s.u.i. .u.m. .e.r.r.o. .e. .p.r.e.c.i.s.a. .s.e.r. .f.e.c.h.a.d.o... .E.s.p.e.r.a.m.o.s. .q.u.e. .e.n.v.i.e. .e.s.t.a. .i.n.f.o.r.m.a.....o. .a.o. .n.o.s.s.o. .s.i.t.e. .p.a.r.a. .n.o.s. .a.j.u.d.a.r. .a. .m.e.l.h.o.r.a.r. .n.o.s.s.a. .q.u.a.l.i.d.a.d.e... .S.o.m.e.n.t.e. .s...o. .e.n.v.i.a.d.a.s. .i.n.f.o.r.m.a.....e.s. .c.o.m. .a. .m.e.m...r.i.a. .e. .e.l.a.s. .n...o. .c.o.n.t...m. .i.n.f.o.r.m.a.....e.s. .p.e.s.s.o.a.i.s.......I.D.S.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.59099335870366
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:76gMtGRtDGP9II7nOSeMbjjeA8nQJ+MQ35Wl:WgMtwDGPRziAnJCWl
                                                                                                                                                                                                                          MD5:45A6719DE4CB98E1ABA3C1C463045B40
                                                                                                                                                                                                                          SHA1:834DD11C28EDADC76678FC65E3ED8AA129EE0843
                                                                                                                                                                                                                          SHA-256:4EA416ECA78CC7159FF8D4A3C28B782A6068C297ECC958B7E9595B67D99304E6
                                                                                                                                                                                                                          SHA-512:C9EE42F658F1C072F91070778A67D58BB3761B70CC9C8141A5D21E80FA8DB12B60B402A3AAB40371ED34C8F8744405DC0CE1D922D105044BFBB4509181B8E97B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...L;.[...........!.........................................................@......Xe....@.......................................... ..|............ ...7...........................................................................................rdata..y...........................@..@.rsrc...|.... ......................@..@............L;.[........]...........RSDS..Q...D..m.. ....C:\vmagent_new\bin\joblist\258920\out\Release\pt\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):116280
                                                                                                                                                                                                                          Entropy (8bit):5.375226630752603
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:q2kLlARh7cQRobnB07lT02pLOKwNZiIWWvDhn/yLGaBD9we:qzQRoa7lg2paKKZiIWahnJk9
                                                                                                                                                                                                                          MD5:22489A4701C2786210C07B4C2B119FD6
                                                                                                                                                                                                                          SHA1:BF65AD84D6C49CEDA7E82083E31269FAC8564258
                                                                                                                                                                                                                          SHA-256:7E3E7C5B19D6B1B146C65D3A82BBC1C475AB511A62F6D9DD7122DC2841443FFC
                                                                                                                                                                                                                          SHA-512:D9FDAAA943CF21ADACB50D3BD3CC7D91BA1319AC0647AE1F36A82A2EF97FCF8EDAD983F2CCE59AFE9F55C7715861FC3906019AA38FD028C2DF80BE8DAC54B229
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d... ......B...............................................Rl....@....................................(........................;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...............................@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):108632
                                                                                                                                                                                                                          Entropy (8bit):5.1900300517535785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:EWPrlAMh74JwFRoadYaT0dpaOKwaZirWGv2y4eCB+SD0:ElJwFRoadYagdp1K9ZirWE
                                                                                                                                                                                                                          MD5:86D8547FE262A69FA5834029C4B32ADE
                                                                                                                                                                                                                          SHA1:F2D31B8038869441BD01A722D8AC7C971C730589
                                                                                                                                                                                                                          SHA-256:981A60800867AB7EC3C3692B4EF293ED6C8A87E518A85745452C55ECBBBB3A61
                                                                                                                                                                                                                          SHA-512:62C0F0146974CE55BB02EAA8E63CDA8C8A0A23395B80798B221BACEC28C3AE87CD8CC3C8BC35CF9EF47E28885A78B46E48D37C6838EEEE6DE6C589205196375D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L.....-V...........!.....d...*......B...............................................f4....@....................................(.......`........................... ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc...`...........................@..@.reloc...............x..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):92216
                                                                                                                                                                                                                          Entropy (8bit):5.771229444714133
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:rmvblAch72IRoi7lT02pLOKwNZiIWWvd8YBPoY9we:rNIRoi7lg2paKKZiIWQ8tY9
                                                                                                                                                                                                                          MD5:294AE48DB9E596596DE3BD5B4C547090
                                                                                                                                                                                                                          SHA1:498D14B2EE7B5AE0415B7A59450CF1BD862D2780
                                                                                                                                                                                                                          SHA-256:E7391D69F7A73EAE230B50A4478D89D74D5DD8B719BF2CB46F82EDD6145ADAED
                                                                                                                                                                                                                          SHA-512:9927D45270DBC75A29F83FB00BDA3B5E5CB40B4F8DFCAC72024D1A847977B8B2179A2B972B48096D93F1F70D7B0013FEE30B5FC5189A6FFD97CD395743F4DBFD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................`......3.....@....................................(....................,...;...P...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc...............................@..@.reloc..|....P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\deepscan\dsconz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19048
                                                                                                                                                                                                                          Entropy (8bit):7.990618864425032
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:384:7AG4SpbwEKYAbje8a66SbGYQoYtIglDTuREcPJpQaylSnHS8oav/nK8Q:rbSj0SbDQoYZlDT9cPJpQaywHS8oy/Kz
                                                                                                                                                                                                                          MD5:246CCAEDF8A26D2141C4E90B74A0D3A2
                                                                                                                                                                                                                          SHA1:FBE747B36D8798F34DB65513702FC6A647FF0954
                                                                                                                                                                                                                          SHA-256:728E90B31CA8AC6BD5689B7CC0FD5868BDFB975E2DB8DB43871EE2DA3D3260FA
                                                                                                                                                                                                                          SHA-512:30463CA7FA57E15B25D586896302F0E5A5205458923D8386EA5128640A25FF0BEF337AB607E56417A7190F2B895BEC422E2D420586364C4C8B7CB1CAE2B3F111
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............,J..`.._.K..;.........L................LLLD..HLLLLLLRLEL.... ..{.....5lG..]jo.{[T....._.... ...B.+C.|..D^..H..R`.I[...BM....9.~.x.N31...pK...U.O..''z...w...XA...P...5X..nP..$.DdP<VdF.`d.V...&....h.y.b]7..P}...~..3..3...[c....1..s...[............j.....P.v...i.H.t......d.4.Q.V.KJ%......q....j+.3...b.i..[.....8...Sdy.....L81Dw5.9.%...9...5..!yk..H.IV...6.q.VW..G.3{&)E..{. ..v|K$.....E.gC@a...<t.....cy.4...~..r.$bH.Y...L...F..gN..O....6p..We..N...r{.9..;=.%..O..%]=..J.Y=#...//U.=>...F......G^........p.........c%.a.I#...G...8..8.or......!....o.S..6...L......1.c..CM.m...R.^.[:.@.0..6.j.v..A..#.&..+-..C...E.}./T...>...F......C..A...<^k.{Q,.2xaU...C%%U..m.....<....D....@.~.p......D...=JJ..q.G@...It...TI...?~.._._%5...L......ns.Y..k.....g..............XW7..CzZ9....ce@..M.....d...H9qB..J.%.......t...(.t.....5.i.2h).jK[.B3.\U.hW...aR.....sN.>..B.I:...n...3.U'.3.2.&......%-...dSM.,.Zx0..G7....myc....l...,.=.;d..f..l..|...!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60728
                                                                                                                                                                                                                          Entropy (8bit):5.4030724413908775
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:2AiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAV:+M4A6UAHRHF4aIi
                                                                                                                                                                                                                          MD5:7B69A7462E6C8DAE22795E2FD7D25A55
                                                                                                                                                                                                                          SHA1:3BC98911017850004F63B2E099B61D8F7B7EA4A9
                                                                                                                                                                                                                          SHA-256:C42E1DFCBFCE8B3D8AB4E70393BC66B82E56A6D99A184A5E2BC81A516C0A5458
                                                                                                                                                                                                                          SHA-512:3A02392AF84B9E30BD2036C4737DD119C1645C69EC0720C8044B7BBF705C3B3D2C561DF62479D3843C9A1A1DBB5F3FC80BD7982864533C6DA7D19241FE170D28
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...................U.V.................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25664
                                                                                                                                                                                                                          Entropy (8bit):6.300932557563814
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7Uoh3ZAM0Dh/Q5DlI76eR3KJ1MXBTDGPhCnQKvrfpMQ3TUv:Yoh3ZAMYi5DWb9KvMZDGMQwpUv
                                                                                                                                                                                                                          MD5:C47840CCFD2693334834DAE926993E66
                                                                                                                                                                                                                          SHA1:D4E93FEBAD01994A2D0A7CDEC8CB82AEC69EEC99
                                                                                                                                                                                                                          SHA-256:93A815B01BCB43B9D29FF3A3D871B644BF1D307D4A9CE08ACB9135D84E3AF9DA
                                                                                                                                                                                                                          SHA-512:B06E43467C662101133DF1C964AA430E52AA3EC6C97AE5A07B1F5D5B2EA5BE16C212FF119DD0416635708413870E437F09034A82B7FC7E88F218D2749D50514A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........(...............................................P......k0....@.......................................... ...%...........,...7...........................................................................................rdata..y...........................@..@.rsrc....%... ...&..................@..@............. ._........]...........RSDS...m>.cN..`.......C:\vmagent_new\bin\joblist\503376\out\Release\pt\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49784
                                                                                                                                                                                                                          Entropy (8bit):6.374888856522669
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:Uy2lF/WFLLpAEl6Zh7laV5tE01ItY+6JWydv7BfBK5y/:x2kLlARh789JWydv7BfByS
                                                                                                                                                                                                                          MD5:CF6B7B66C421B8CC2422B1FFB65DAA99
                                                                                                                                                                                                                          SHA1:9BDE30AB29B606153D97F3C85078438CCF06068F
                                                                                                                                                                                                                          SHA-256:C97ED6F3320D5209AFCBD5B3140F57093B1B1491958C1F6429420C57E1F5C3D7
                                                                                                                                                                                                                          SHA-512:60BA67719650884AE59C9A87AD49876ECA04D945E282A1AD1635068949B3D6EEF1B9D21FEC32B59C535CFE49FC1E29F21797D64EADC347CA856A568DF5D1AEC0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...].U...........!.....d...B......B...............................................@.....@....................................(.......(........................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...(...........................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48248
                                                                                                                                                                                                                          Entropy (8bit):6.069334646544668
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xXHGdBPASgYoH6dzSnq5TmtzG3TpMtaWVxs8lAKYRrtsPpN:wASgRcSqNmtzG39MkkxA9rtKpN
                                                                                                                                                                                                                          MD5:BDE710C15580DC337EFBBF8E0AE24069
                                                                                                                                                                                                                          SHA1:32A124ABB080D30C010C5813FBD55B1CDFF43423
                                                                                                                                                                                                                          SHA-256:149C39310CF7E1451528675427508BAAB80B379A9D73B31D710A0ED5B5881654
                                                                                                                                                                                                                          SHA-512:501EF6DA36065BCDBD87647D43853AA9CE5B23B812C14F41CD7310DB89E95762DF4D6C392A40F42D8FB4630A8FCD467F60C4786E2EF28B8E0F7959BAB0117574
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...N.U.........." .....Z...F......................................................f.....@.................................................h...(.......0...........................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...0...........................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20960
                                                                                                                                                                                                                          Entropy (8bit):6.300380119548505
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7yo1cspTPHF9mAJM0QXnA6ki2cP0iwfLb2PSES+ShjmM6IGBkSk:1S0gnz2cPfwQTS+ST6nkj
                                                                                                                                                                                                                          MD5:B783F0E4A46BFD6D9F95C5F3658747D1
                                                                                                                                                                                                                          SHA1:2E07CDA17F34DD3C9C265852658878791908C356
                                                                                                                                                                                                                          SHA-256:335131047B69943E0A36798D09008437FA0DC75720BCE966712D602EE974825B
                                                                                                                                                                                                                          SHA-512:B5161645B0962B4F6EC9150DCD976B68D64BAF1AC0E2A528907E176A588CB7EE589F48669EA3AAAA8212EACFC45303AEAD1C6593A5D010014CC8B1E02CC72AB7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........$...............................................P............@.......................................... ..."...........(..H)...........................................................................................rdata..r...........................@..@.rsrc...."... ..."..................@..@.............#pf........V...........RSDS...q..5J...c.uG#....C:\vmagent_new\bin\joblist\815456\out\Release\pt\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\appmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):31292
                                                                                                                                                                                                                          Entropy (8bit):7.98697494864025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:drQ8ffdzS2KN1gQxCFeWTuIoR7HBssluEqd8Knq:e24N6QckWT1O4q
                                                                                                                                                                                                                          MD5:DDDA5BE2E45D1C5229CD561A03825908
                                                                                                                                                                                                                          SHA1:D9207564DC229C9A05D9A7BAF8C7E2D17C62072B
                                                                                                                                                                                                                          SHA-256:C308EE41E48CC498C396A2CCBC57B7D29D058DD145F9867887544CB74112D63F
                                                                                                                                                                                                                          SHA-512:B16A67086A9D435CA17E35C7EFFDB639CF934A8671CF9F99F4E8F6846AD7E71BE71AED3BDE77A63F3189C155391EFE5287589CF6332DC8BE02E52C90C924EFB3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5.................................................................................................................a.p.p.m.o.n...d.a.t...............................................................................................................q.W.cNA6'!`;..#..[\.t.....7....{..s.....|B....H.r.%..]..b2r.K.P....7]4=....1.$9..~...(..V'Y.;...L....-...O...E.d.T.F..C).....#..w%..w.`...0....C..............0............C.F..*:...3G.!T...O.Dlo,'Q.....\S..3....c......ETN.<..#~..+>o...'L.Q.L..#.(....F.[.>.s-=?.=.u...H.b...L.\na=0'..h....Yy..H,...{..JJ...C..L......,.3..wO@K..&.Q\...5..cY&..2..).2.>.2`@VQ..UO.,d.i.F..@..;...b-<."..6:...g....i.<..0(GX...:...9.L<$."D..{.....`...=a.P..E.l... /..U<J~A.^F5sp.s.U-..Gf.R...=....'..%.>.ki..$\...N...>...A.Y...8.h.e...4...Zy._175.&.6..Ih.8.0L.=.cPD*.U...Uz..T..a'..k.po..;B....6.'.Z.'[=Z.,8.....3l[..^i.Q.-\S._{...Z..5.7....K+XD....Q.V..p......w-.9.(../.....0....,..Z...G0....ae...<.U.\.52x.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19936
                                                                                                                                                                                                                          Entropy (8bit):6.476887186386839
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7DWHgEX+9lDTjKb6ki2cP0iwfLx0uS+ShjmM6IGBkSdZ:93jK22cPfw2uS+ST6nks
                                                                                                                                                                                                                          MD5:22DB34FF4BDDA5DFB45AC4E80AE2CCC5
                                                                                                                                                                                                                          SHA1:8F10FBFEB2A52298AC61477E8F9486162247E44A
                                                                                                                                                                                                                          SHA-256:7524FBA89F161B16A1F305BD7EB0F66E08432BF1FA1224F3500228A45BF28E90
                                                                                                                                                                                                                          SHA-512:297581A1F1EEA89D877941FB8FCEC1FA569CDB40E31B61980260A039BDED187AC4E031D31EC08433901A90D57EBF865232C4C6B6B95C3F1E6ECA1A663962490C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!......... ...............................................@............@.......................................... ...............$..H)...........................................................................................rdata..u...........................@..@.rsrc........ ......................@..@.............#pf........Y...........RSDS.(....O...tkA.{....C:\vmagent_new\bin\joblist\815457\out\Release\pt\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.968514351588424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:5vHP8qNfXOKM5VHblx1qhvmVqC7exscB3neUvESwTPprqWPQTUDnwENL1c:hHP8KX5M5VHRivmsCescReUsZPqid8
                                                                                                                                                                                                                          MD5:BD29091BA65B3FC08C79654997B4C82B
                                                                                                                                                                                                                          SHA1:3B353EC41DCC96D898715F6474656F13931C1B61
                                                                                                                                                                                                                          SHA-256:A3CFC3C8F95F0ED56306D28AC87408F10875C43BCA7778C6E1CC18C7A3441183
                                                                                                                                                                                                                          SHA-512:AE64DAE0E4025968BFB14E57C2FAAB0C9DA39943DAE9C884CBBD940433B29613C090B98899DB847C94B265F969A6ED3CFEBFF35AF284CA9619E6E25937067650
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................A..a,.@.-_...#.....2..vI...^..2..H"..........yU.;.i[..{.~:p.u.!...&..JnZ.......)px...@-T......7.HK.)...Z...[@n,4..h.C.!....#..w%..w.`...0..$................0...............q.%H...CK.d.d.=\I...).../..UQ.9z..@.(..gc3v.... ..v..+......`f.~.z........o+..}..az............(-z......3.*..7>T8O...._='..P.hX.....Itvz...r~$.....r.3....L.e..H|. z>x!;C..J..a.=..c$.....6..6..._s~..b"-...!.fI.&....w.]b......+....b...U./..m.6[.o.DS...=>..._C8.Av..yy.^*Sh-.s..Z......w\.n.;...q..h..Q.....<..V.........t.....4.6..F..=Q*..........0B..h.ja..=......|..>dz.,.)......&.......3..|..;]"q..A......R.y{.......$.d.L.:.......]j...G./<mFJ.!.,Lc.....Fcvw..{4.SH.*..m..l..|.?`N=d.l....O..y~....u9..?s....Jy..P

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32908
                                                                                                                                                                                                                          Entropy (8bit):7.98579519717503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:mqPy0zBxmlBLCxBIZuPVOWdT0bQUu9d2+8Pc1fCrGrP:m90nmlBLSBjt/T0MUu2ofCrY
                                                                                                                                                                                                                          MD5:F507C8DB8F8EC9361F36608408C9939E
                                                                                                                                                                                                                          SHA1:F3915EDB67FC281DDE5657B383E3A5AEDFE96BB8
                                                                                                                                                                                                                          SHA-256:DAB50E3C2787808BEEB0B377AD7C3DE2C518578B9F7A4EC4AC29063D59C00B3D
                                                                                                                                                                                                                          SHA-512:CB09E4F033B873211BFA8B8B82FA207EA5C176D8D686487C2253214F5F965734D2A16A04AE41B849FFA20B3B03814714274B749F07DBC28A0A5676A86630FEEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................r.e.g.m.o.n...d.a.t..............................................................................................................`1.!.../.C~.}.Q.i.{,..L......B.PG...xJ..L#.......B#.5J?.j}..f..`x.F.dG.p......."...VOn%.%M.D.;.F;.XL].o.S.DK....F[.....]....#..w%..w.`...0..d.6..............0..........X.6./).5.b..V..p,...u}".~..t...0...r..6,...c.....y..>.....lxh.t...O...-}~.c..1.'zv:..s..t^.|....%.."k.c....n.....J..x&. ._.-...\.9>.$.q.).~........v...b..IY.{...cp.f5..F.&..o.].V....0..J....w..f].%...!..\t.s+.J}....7.X..nI.z.M0...5...)x.8\G.._..w@.'..1....?=D.y.:Hw...9.@.Y.9.hd...$h^..I.G..gy..j.......5...nB.4 0!e..N...WQ.k....:x.9.`........3....38...W[..K1..{Q`..5P&z..8.J<.`.'+.i.y..0.a"Zu......KS......M..h...O..qbj..$../Z.M&...;...`..n.>..#.8. .m...|...s.$.K.T*c.....H.Z.S...P..5..#....^[.a=...........V.k..)r..%.i_.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):6.778105959900751
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:79x2dlkEyVl1fFBd6ki2cP0iwfL7r9iS+ShjmM6IGBkSG2:LjfFBY2cPfwDQS+ST6nkK
                                                                                                                                                                                                                          MD5:EF1500D1CDADE22288C1AD1C7B81D4E8
                                                                                                                                                                                                                          SHA1:76A64E73E48E2DF0E36BCC5816DDC263E47E8CD6
                                                                                                                                                                                                                          SHA-256:30A95F2FA0AD8A306F172A6ED9D36E259B21D4C444E15F5E03FBBC922076423E
                                                                                                                                                                                                                          SHA-512:A291D1B7D78F70727507E84597015B1618F5A13269CC80118026918C555E082E9224A1CB2A7BF06889574A15E6AE1CDC6B8C8F100C85FC37D9412F50DE4252D3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...`frf...........!.........................................................@............@.......................................... ..................H)...........................................................................................rdata..t...........................@..@.rsrc........ ......................@..@............`frf........X...........RSDS|....#M....xucA....C:\vmagent_new\bin\joblist\815994\out\Release\pt\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1060, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1085440
                                                                                                                                                                                                                          Entropy (8bit):6.833167701427219
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:pMM6kj6Mv0SJYJG234hv1GE1n9i15C3B8B3php7GehEm:oQ67SCG23y1GE1nk15hp
                                                                                                                                                                                                                          MD5:FDD1E8BCDE0AD6A16F74D726BEC71FCE
                                                                                                                                                                                                                          SHA1:6D9461E0BC5CF40424EE745D618B97FC4FE52263
                                                                                                                                                                                                                          SHA-256:2CEA7306FBAE0790E183FAF03CFCF026BA903912ED3F27520FC8DBA331FF8484
                                                                                                                                                                                                                          SHA-512:917DE7BE15226905C3D5C07A89337A57C69C53C1994AA2697119433462F8A5E417EDD09D869D6D06667ED537F18C68E2E7FC5BCC0411062441EA176A214C94A2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......$.................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\libsdi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):105676
                                                                                                                                                                                                                          Entropy (8bit):7.998476384795446
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:t14ap84othyTn2v1GxUuv2CkiBKF09Mz+2o:t3i4otcT2vkxKJisJz+2o
                                                                                                                                                                                                                          MD5:CDD1E6ED1E8A65A3A7BD793D4E54540B
                                                                                                                                                                                                                          SHA1:1A4999578766ECD8CAF1A6552BEC6AD6185DF2F5
                                                                                                                                                                                                                          SHA-256:6E53A26F5845C54B580B9171CA97F6A4ADF7DD5F22EE1E40613CF124D6726459
                                                                                                                                                                                                                          SHA-512:540322229E4AAC825F5D15E454717BFF2074D846E50E50F7EE9944937FDB6CDF505C6E809ECF3530A55A7C8C2971683BD734F7EC51465D4AF45971F76E2E4339
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..., UX*N.....z.....D$.....`...@..(W..~.?...A-...4~5L.r..L,"..$O.e..O..n.w.Z..D.g.x..a..VP./Uc9.t%D..E.P&...l6...9..,P{..Bw......^.m4.+X(.9..........E..r.......3.=....h...KrT.a.R}....P.Ug..16..>...`..... :.......|;.G|........dd.._..U.q"Y].....5MoD...p.>...ny.%|..w......<.U.w.n..J..y.uE|Q..Jf.h.f~...}.[...Gs..%.O.X.......3~-s..H...[.....0.4.{.EO.........1@*...5..:....BR.Q....Ak1*2.....QC..>V...../o..MR....9...-S>..9...}.r.....W.(O...^...&....'.z.].N..?Z....Y.C>e..+j./...2<h8.m+..K.{+...!...s,...5...<"...3y..r.,.......0Y^.'......Cu.M........O.r.V\...C..@2...Ji..u..!...[...........=.p.Ci...k_..#..........sm.s..;.z...k_.tDW.J+Y.t./...'.x.h..=...PK.4..P..:....0.2k...ws...XR.P(...E.@...i..N$..-.W.y....h#...B.\A|.....!FS.+k.n..........+...f....X.6h..3..Zg8N.Od.8.2{.5.&..M...8+.....T4.M8..@.v....r...}$.xr$#.AZ..sIO..........k.x.m.....+.,.....m0..bo.....7..Q._........A...{.|.N...p#..Z........|.PH..4.Z}X.S.....o.I...J.....2}8.d..xK4.0.Q5.$.`..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 217, database pages 790, cookie 0x8, schema 1, UTF-8, version-valid-for 217
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):808960
                                                                                                                                                                                                                          Entropy (8bit):5.830151158676481
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:o/nCExkRpiJhfKNJhhD5PpSoPd/m9muisxaAVxkf7:qCExkRgJhfKNJLhxPJm9muTaAc
                                                                                                                                                                                                                          MD5:038B56F3901E4AB2A6D21CE626376C9E
                                                                                                                                                                                                                          SHA1:0D5250B733C7CA06E5BD141F5919A338CCBC7611
                                                                                                                                                                                                                          SHA-256:58BA706961DC3101CF3917F302257A46783770702093FEF096ACDE15945467FC
                                                                                                                                                                                                                          SHA-512:859162B8349E192532E6A5E6C84CC5CA0205E504C853C13DCA70351698057B2DB365BB5409DD8C81D569E5292655C95565BD4B8C8CD6BDB468FCCB754E67DEDE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.........................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):30840
                                                                                                                                                                                                                          Entropy (8bit):5.946368277510864
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7NmOacsultAgwBAP3ExcizfbiEFM8z7eM0h:p1t4B23ESYfelhh
                                                                                                                                                                                                                          MD5:A7AF6EDC42E5DACDA4D7AC0D4BCEE813
                                                                                                                                                                                                                          SHA1:6ACD980DFD42018DCBAEFF53CE3053F942945688
                                                                                                                                                                                                                          SHA-256:F92155DEE52D5DCB86F12A9D6B92EC84F1687644B2E3F327E6F2718149C5A80E
                                                                                                                                                                                                                          SHA-512:FDBCC71C5AE3149598D6C6B7EC8279529DCAB17A52630DB1D169D68FD323212B9CEB072C5BB9FA641E28A16AEE017E87D36ED9FC81CEA6BB13A62EF5BEB59DB8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....YKU...........!.........^......................................................Fq....@.......................................... ...[...........b...............................................................................................rdata..............................@..@.rsrc....[... ...\..................@..@.............YKU........v...........RSDS=...D.kF.k...e......D:\Projects\SafeGuardIntl\branches\SafeInt_V6.2\i18n\I18N\SPTOOL\PT\Release\360SPTool.exe.pdb.......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1852
                                                                                                                                                                                                                          Entropy (8bit):3.6355839694749847
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uNjDNZDrDwNtbTnD3sfBDFsfbJUvBDBtKYlvHY48iIDf:r3NHnfwNJTD3iFFibmvFBtKi/KiMf
                                                                                                                                                                                                                          MD5:254B81C69801108377D0FCD2138B38E0
                                                                                                                                                                                                                          SHA1:CBF93737825091989395EA035B65343373A1EEEB
                                                                                                                                                                                                                          SHA-256:C4B60C2075BCDB5E1E436B1EF8AA3B430ECBD3D215C399D133E8D9E31E3611CC
                                                                                                                                                                                                                          SHA-512:D858E12B8DDB7987737B1EAE282B56E41CFABEE0B038981D8EE891B223D082679C5E5CA29FACC9939DE3CBB5F5562C9EFA97D4F3A82C20BC60CA79D764A6E7FC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=.U.m. .p.r.o.g.r.a.m.a. .e.s.t... .a.c.e.s.s.a.n.d.o. .a. .s.u.a. .w.e.b.c.a.m.....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=.P.r.o.g.r.a.m.a. .s.u.s.p.e.i.t.o. .e.s.t... .a.c.e.s.s.a.n.d.o. .s.u.a. .w.e.b.c.a.m.....I.D.S._.T.I.T.L.E._.R.E.D.=.P.r.o.g.r.a.m.a. .m.a.l.i.c.i.o.s.o. .e.s.t... .a.c.e.s.s.a.n.d.o. .s.u.a. .w.e.b.c.a.m.....I.D.S._.N.O.T.E._.B.L.U.E.=.S.e. .v.o.c... .n...o. .i.n.i.c.i.o.u. .o. .a.c.e.s.s.o. ... .s.u.a. .w.e.b.c.a.m.,. .r.e.c.o.m.e.n.d.a.-.s.e. .b.l.o.q.u.e.a.r.......I.D.S._.N.O.T.E._.O.R.A.N.G.E.=.O. .p.r.o.g.r.a.m.a. .s.u.s.p.e.i.t.o. .a.c.e.s.s.a.n.d.o. .a. .s.u.a. .w.e.b.c.a.m. .f.o.i. .b.l.o.q.u.e.a.d.o.......I.D.S._.N.O.T.E._.R.E.D.=.O. .p.r.o.g.r.a.m.a. .m.a.l.i.c.i.o.s.o. .a.c.e.s.s.a.n.d.o. .a. .s.u.a. .w.e.b.c.a.m. .f.o.i. .b.l.o.q.u.e.a.d.o.......I.D.S._.I.N.F.O._.A.L.L.O.C.=.P.e.r.m.i.t.i.r.....I.D.S._.I.N.F.O._.B.L.O.C.K.=.B.l.o.q.u.e.a.r.....I.D.S._.I.N.F.O._.R.E.M.I.N.D.=.N...o. .l.e.m.b.r.a.r. .n.o.v.a.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):109056
                                                                                                                                                                                                                          Entropy (8bit):5.342277508533851
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:+ORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3n:+OBrUC4jyUJGKzgSg+p6OiFF
                                                                                                                                                                                                                          MD5:1211C6E9204AA1ED30BF691A713A6775
                                                                                                                                                                                                                          SHA1:B35131B18A5CD7B61448A3CDADE2558882279E29
                                                                                                                                                                                                                          SHA-256:0D252F660323CB32D26A3D48131F3E09CFBECE9F93DB37C900A2422EDA6DC6DF
                                                                                                                                                                                                                          SHA-512:CB085AD4CA02723CD7B4B0F6FF09C6E58BA2D67AFD669160699085B615C32D12C2E746DB5A6150ECF54A362013E36647967254BD911AF1FF1DA16EAB48091C1A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........n......................................................Ao....@.......................................... ...k...........r..h7...........................................................................................rdata..............................@..@.rsrc....k... ...l..................@..@..............2\........z...........RSDS.A|...N.jY0..,.....E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\pt-BR\Release\360procmon.dll.pdb...................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\Safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54904
                                                                                                                                                                                                                          Entropy (8bit):6.216332578988871
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:1CG11xWF7Lp/El6Eh7lKlI01y+6JW6QtyLBAClf2:cGa7l/8h7IsJWdyLBAg2
                                                                                                                                                                                                                          MD5:95C57DBE33C3E281D8FD91B96CB46A94
                                                                                                                                                                                                                          SHA1:CD86DFAB366C43653ABF575572AD889A63621F2C
                                                                                                                                                                                                                          SHA-256:5B2EB60E63475EC2D26EE58108EE356A372308CDB4D021ECD4DC4E8CD7BFEE30
                                                                                                                                                                                                                          SHA-512:3F703095A8209E628B1D87F2B00D76F70CFB3C217B6A6E0EDCBD8F19AC6DA3751CD43BD3F8AC3586031A38EB58DC1383CC284BC5893856CDE909F92556461F84
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...;.U...........!.....d...V......B...............................................h.....@.....................................(.......l........................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc...l...........................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):53880
                                                                                                                                                                                                                          Entropy (8bit):5.892942344308034
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:J3v+tnPKY4PWWYzpnD9UT1tFGHXjpjqdV8/rfroLoktfu6jeDm:+KJSpD9+1tFGHXt+PCrofFje6
                                                                                                                                                                                                                          MD5:2E798AA65C0B1B846E08BD842A86BBE8
                                                                                                                                                                                                                          SHA1:00D4AF1D98D0AB9A4D89D10A860D3F6417A00F8E
                                                                                                                                                                                                                          SHA-256:69D727F4DAF223278A20D9D5DE97921356DD8D7D795DA5D3E74474E98103B12F
                                                                                                                                                                                                                          SHA-512:53F6687FD6DD93E96DE6BCB16B81A7E5EC197FF69AF7E671C5BFC68819BE4CFD2125F3E89857340D86B7643017F868BAD88B08657EA129BE839301CE3A9C6EDB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...|.U.........." .....Z...\......................................................e.....@.....................................................(.......l...........................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc...l...........................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21504
                                                                                                                                                                                                                          Entropy (8bit):6.707246504680937
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7LM3YE3wI70HVJeMBHlF7QKvrfpMQ3nm8:PMIE/Q1zFF7Qw5m8
                                                                                                                                                                                                                          MD5:B52351E6C1048430430E06F335696FB7
                                                                                                                                                                                                                          SHA1:C6353752F2759056154A7EB9746605ADC3DB9A43
                                                                                                                                                                                                                          SHA-256:C8C31CC2970BE3C1DA979847D9003D355F225E20DC95F8D44F3386D65B61C0A3
                                                                                                                                                                                                                          SHA-512:2087238CEFCC2CCF06CE195FFBE24CF8F5EF4BCF98FC15C1D178B9A20DAAEBDFC1A3E15A5E419C6AB3DC9DDD92AD7AF88718740A7A20FD605A494EDE740AD38C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........................................................0......:.....@.............................................................h7...........................................................................................rsrc...............................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...............................................................................................................................................................................................................................................(...8...................................................D...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.108267200199422
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7ICXB60SZrI7nOSeMB47jsKA8nQJ+MQ3XF:UCXB60SZUliHAnJMF
                                                                                                                                                                                                                          MD5:1BB8A4644DCCFD4A6E8D380C81062B4C
                                                                                                                                                                                                                          SHA1:9D1E86AC19DA2B8B682D3F764BCEFF60292DA1E9
                                                                                                                                                                                                                          SHA-256:F07154C10668BD86580DC6334E66F6F75EA326B5E762B3610CFB4EDF93E10368
                                                                                                                                                                                                                          SHA-512:B97AF38A2E27738C4FC075BB6DACE1C60D215DF4D470673F3C2E55901D204423B9F62D438AAB3683D60DA2B29889E16D2BAFE2CF1E8599675F71D6C3D180F14D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0.......l....@.......................................... ...................7...........................................................................................rdata..}...........................@..@.rsrc........ ......................@..@...............[........a...........RSDSE..1...J.B..........C:\vmagent_new\bin\joblist\259671\out\Release\pt\UDiskScanEngine.dll.pdb............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19000
                                                                                                                                                                                                                          Entropy (8bit):6.975192455841326
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7tHQqh5eR3K+h1MeK6j9xDGPhCqgQKvrfpMQ3l:1QqhU9K0MeKg9xDGqQw7
                                                                                                                                                                                                                          MD5:55BD39C912CEB0ABEFE1A7A772B53415
                                                                                                                                                                                                                          SHA1:73DA858BEF4C06B2F57600C434A1D9740DB8FC35
                                                                                                                                                                                                                          SHA-256:49F763DD55FB2BAB5D53D8F56D1D80E301BEB9BD75F72782D901A29AF494AB39
                                                                                                                                                                                                                          SHA-512:6301120A49425C3C516BECCC0B2F5F0872652436CC7E08CDC501C9B09732B51EE8A9317E606B8170813FE715BCFE9CA6212A5330705A5B8908388FE671C76BB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... ............@..............................................................;...........................................................................................rsrc...............................@..@....................................................................0.......X.......p...................................................................`...........................................................................0.......................@.......................P.......................`.......................p...............................8...........................................`...............................|...Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................C.h.r.o.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.784826163164485
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7L0Mdmo5yMrj1grjzR+vnr9ZCspE+TMArlET:7L0cmVM8z7eMSET
                                                                                                                                                                                                                          MD5:9506540F8C42C98A30761F4F4D66632C
                                                                                                                                                                                                                          SHA1:DE54C34D7EFCC92E4AE4C9BB4B6EC542E5D744C3
                                                                                                                                                                                                                          SHA-256:C055334B303265903AE6AE7ECBFFE1FE915B075368137E29AE4D652C1800C1D7
                                                                                                                                                                                                                          SHA-512:66DF97C20C264D7DFE5AA8D6B60DDC9C31EEA9AA6286A35544EFF612D804D33B99E50CA5621226E89BDB362C7A40EAD203FDDE118E5810901418B414C0168D0E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ......B8....@.............................................@............................................................................................................rsrc...@...........................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...B.r.o.w.s.e.r. .S.p.a.r.t.a.n...B.r.o.w.s.e.r. .M.i.c.r.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.694089762589698
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7oMMf6DyMrj1grjzR+vnr9ZCspE+TMArk5CH+:7VOpM8z7eMHb
                                                                                                                                                                                                                          MD5:A5E5A4DC0064C2CBAF31D5D0A10C3258
                                                                                                                                                                                                                          SHA1:31EB5894BB7D7EC19F92FD78E2C301A3641A5C75
                                                                                                                                                                                                                          SHA-256:09E69BAC2FD5023D8EE6FE67E5D072AF4B69A7AC4FB172032EC3604C89B30B13
                                                                                                                                                                                                                          SHA-512:1C75EA6E923AABA66CD12964EC3BEFDB8267E66603F989B79FB20ADE788D24E2DBBD68444B1BE4078CF5778C219A81F9729EFB3CC747884606D2CF606AFF32D5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... ......#m....@.............................................................@............................................................................................................rsrc...@...........................@..@....................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................................................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...B.r.o.w.s.e.r. .S.p.a.r.t.a.n...B.r.o.w.s.e.r. .M.i.c.r.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):470
                                                                                                                                                                                                                          Entropy (8bit):3.681088403465995
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Q++ubx60GQF5sAlXmhR4jvgE5KE9QNIKAl/h8E966N3:Q++uSe5sA9NvFLnKAVhN66N3
                                                                                                                                                                                                                          MD5:96F13109D95C2A36CAD2B3800E9094B8
                                                                                                                                                                                                                          SHA1:FBB488ED0DE52B4A9C56A43E8C6D592FCF445947
                                                                                                                                                                                                                          SHA-256:7F77165EA2B988CDC6975A3BEF3AC0BFECF0A01EF6E0857884EBEA846C8FE57D
                                                                                                                                                                                                                          SHA-512:9BC93368F32FF5387E6BE2A0974BFD896001285995E5BBDCB3B05783ABA49B42835633307433CEE81C769A69C6C36A6D3D133FAD8B6A4967F9FF1A56D204A59B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=.L.i.m.p.o.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.A.r.q.u.i.v.o.s. .s.u.s.p.e.i.t.o.s. .d.o. .d.i.s.c.o. .U.....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=.L.i.m.p.o.s.:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=.R.e.c.u.p.e.r.a.r.....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.P.a.s.t.a. .o.c.u.l.t.a. .d.o. .d.i.s.p.o.s.i.t.i.v.o. .U.S.B.....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=.R.e.c.u.p.e.r.a.d.o. .c.o.m.o.:.\.n.%.s.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8532
                                                                                                                                                                                                                          Entropy (8bit):3.559396696977397
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVlujNqWIajWwapG4Bj8n5d6WSbJ1J9Wa5sFWbmc:29+DgRgiz0G4Bj8n5eWfFWT
                                                                                                                                                                                                                          MD5:A134096BC6F63448B64CF48C6463B141
                                                                                                                                                                                                                          SHA1:7B4EF26F68BA2CD35365C4A158FC842445CE0874
                                                                                                                                                                                                                          SHA-256:DE1D0FA92911957AEB41A68403B53E96D2B8294A4BC6C3DACA4CC2876FAC1D8B
                                                                                                                                                                                                                          SHA-512:AD46BA27F8438EF225E0613B7DEFCD6FAAAEE0E734D7364B37EE3712E5F12429ABD6012A9FF870B6943DB744B06A5E4379CCFE1CAB50D40EB0729688C8CD72F7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.3365396894303228
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsXg6PCabR:r5u5/+mMks5qTp1mNqce9Oow6aabR
                                                                                                                                                                                                                          MD5:81707BA2E4C29C175660AEC36C696492
                                                                                                                                                                                                                          SHA1:6DDB9368038BF2C44860215D937E1FB93F5652AB
                                                                                                                                                                                                                          SHA-256:5A6A9FCBF327CE248FDB34F3A762CB1D4FA17E3C6BBB530479DD8EA63F605ADF
                                                                                                                                                                                                                          SHA-512:0B6A7701D94C1E629B9402EF5A954185D6B3495A37F15AEBF93FE18AF4CDEEEA913E7BCBB5195A25B9737F8238E76B27871870CFAD9413C3C8D48DB5D9D54CE3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\pt\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10568
                                                                                                                                                                                                                          Entropy (8bit):6.785701716508745
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7R6309YrHwyMrj6Pu7CrjzR+vnr9ZCspE+TMorbFaR8F:7R63jr7MCPHz7eMI
                                                                                                                                                                                                                          MD5:9D946A13E391BADCBFF0CE2703EF0766
                                                                                                                                                                                                                          SHA1:5D514060B82E9AD56912E4E0FC1D630CEA13EBE4
                                                                                                                                                                                                                          SHA-256:C4F495E888ACD96842AE984083C44F230453588F8F96F1D1B618ED98B2B57F57
                                                                                                                                                                                                                          SHA-512:320C44CA4452071308097373C63528576BB9C1C3A81DA58B49758ECF95DBF63A80EFF60FCECE0702AA2A558A1388E88A5B8FF9E0F4C853846C7751EBD9E68ADE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....~.T...........!......................................................... ......z.....@.............................................l............................................................................................................rsrc...l...........................@..@....................................................................0.......X.......p...................................................................`...........................................................................0.......................@.......................P.......................`.......................p...............................8...............................................................x...............Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):142400
                                                                                                                                                                                                                          Entropy (8bit):5.52808016593563
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:jimVVOWFbLpAEl6kh7lqFVi01nwoMRoNVaTl5IO/Qojn/BPO7BcgzAnJuo:+mvblAch7o2RoN4XDj/BPOtYso
                                                                                                                                                                                                                          MD5:C077E17941A28D6A6C93F2928A00AFF8
                                                                                                                                                                                                                          SHA1:E62A6EA1613205F7376993D5323ECC83A15F0FF6
                                                                                                                                                                                                                          SHA-256:C0AF71BDB2B79C9258577359D09EE41C394608E1F791E21BF6FA0A4FE3806F5A
                                                                                                                                                                                                                          SHA-512:9E8853D4F2174A6253701EC65269B511BA82B26588DA10926CC788CB926DF1C993DF368CB5D0AFF6A83964874ECCDD490E5E5C0A1C492275E497E73532D5A49B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L....H.[...........!.....d..........B........................................0......r.....@....................................(........P...............7... ...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc....P.......R..................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1776
                                                                                                                                                                                                                          Entropy (8bit):4.160889907774699
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q++uLTCVKs4WZmMdlJa1QYDrtnwQZD3SKX7ZEiWALBJOeHiIDLJX:r+uLTCV9tTde1QYDBwQV3SY7ZEqyeCUV
                                                                                                                                                                                                                          MD5:9489CA7B46900F2557E2BB560E4DDBE1
                                                                                                                                                                                                                          SHA1:78182CBBA82475800A083D657534118BED80A12A
                                                                                                                                                                                                                          SHA-256:77CCD34C116CCB0553A20EE7E9C00CBBDA9A8E28A731D15481C595956BB210FA
                                                                                                                                                                                                                          SHA-512:309B45FA25C3F132FAEF5310288664899E2AB81B9E2835FD44C79C286963454D1B9C4511E0D302EC3742DC5D3AFEF17549AEABA112BBC183CA587EBC2306C281
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y. ...B.G.5.B. .>. .>.H.8.1.:.0.E.....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=.A.B.>.;.:.=.C.;.A.O. .A. .A.5.@.L.5.7.=.>.9. .\.n.?.@.>.1.;.5.<.>.9.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=...@.>.A.8.<. .?.@.>.I.5.=.8.5. .7.0. .4.>.A.B.0.2.;.5.=.=.K.5. .=.5.C.4.>.1.A.B.2.0.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=...@.>.3.@.0.<.<.0.,. .:.>.B.>.@.C.N. .2.K. .8.A.?.>.;.L.7.C.5.B.5.,. .8.<.5.5.B. .>.H.8.1.:.C. .8. .4.>.;.6.=.0. .7.0.:.@.K.B.L... ...K. .=.0.4.5.5.<.A.O.,. .G.B.>. .2.K. .<.>.6.5.B.5. .>.B.?.@.0.2.8.B.L. .M.B.8. .4.0.=.=.K.5. .=.0. .=.0.H. .A.0.9.B.,. .G.B.>.1.K. .?.>.<.>.G.L. .=.0.<. .C.;.C.G.H.8.B.L. .=.0.H.5. .:.0.G.5.A.B.2.>... ...K. .B.>.;.L.:.>. .?.>.A.K.;.0.5.<. .8.=.D.>.@.<.0.F.8.N. .2. .?.0.<.O.B.8. .8. .>.=.0. .=.5. .A.>.4.5.@.6.8.B. .=.8.:.0.:.>.9. .;.8.G.=.>.9. .8.=.D.>.@.<.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.616034039492855
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7OPtGMtDGO4JI7nOSeMB4jcsoz2DDMQ3r:CPtTDGO4y8csozkP
                                                                                                                                                                                                                          MD5:D9C6B8F21D7371B023B71ED7939CB5DF
                                                                                                                                                                                                                          SHA1:0A053E5EBC8468E6FE2983C89EFADBF9876607F8
                                                                                                                                                                                                                          SHA-256:A3C6F16B052477870977EC63A0EF4D2054EFA1AEFC2009D263C36877DDFDF116
                                                                                                                                                                                                                          SHA-512:CD4AC204D94138A6A71EBB42A1A2BCE648276D027249B2C43782E717048EC4D8CC11D55FAD3ED42B7083D175DC426F4005D7B2BFA990E4D442246C6FBB57E841
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...Q;.[...........!.........................................................@......K.....@.......................................... ..P............ ...7...........................................................................................rdata..y...........................@..@.rsrc...P.... ......................@..@............Q;.[........]...........RSDS......C.|.0..LU....C:\vmagent_new\bin\joblist\258920\out\Release\ru\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):109624
                                                                                                                                                                                                                          Entropy (8bit):5.887628719446109
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:vy2lF/WFLLpAEl6Zh7laV5tO01Nt1oMRobqEsBV22fzBatT8P0gYagPxVESBJxyS:K2kLlARh7qXRobAkW0KpzqBJ9we
                                                                                                                                                                                                                          MD5:EBFBAB569250E750AA8B31EC3A147899
                                                                                                                                                                                                                          SHA1:2F4E6EC36CE1A5A8571DCBFEF8244D76BBF212DC
                                                                                                                                                                                                                          SHA-256:2043E6DA1639C6D10E67D2748636BC622296C7158DA74AECEAB81C8CD2192BF1
                                                                                                                                                                                                                          SHA-512:EFC4C6A12E777486429926189B50B88CAA970AE5D6B51D6BE51AA686FDAC7D9FE741C40E1BF5EC11B2B04020A1E03362FF765D8EC238C2DCB84885B50B772BD3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B............................................... |....@....................................(.......@............p...;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...@...........................@..@.reloc...............`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):110824
                                                                                                                                                                                                                          Entropy (8bit):5.940633593176444
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:zSWFluWFrLpAEl60h7l61Hz01EPoMRoXg90Yy1a8zBnpTT8AvgYagjCMnSKJcyS2:+WPrlAMh746EFRoXoRepcErzWBBxo
                                                                                                                                                                                                                          MD5:4DC3DBC8CDBFA1AFFB76CC0A89DC31FE
                                                                                                                                                                                                                          SHA1:1C7F9962148DAEF70815DBDCE0D7542EEB28D074
                                                                                                                                                                                                                          SHA-256:F9F2DA182BA3BD71A83288858BDE9AF9CB4602FEC7BDF64987D8E4B5767F6F14
                                                                                                                                                                                                                          SHA-512:2CD9AE4DB7AADA4BC86D4AAFF6700530DCE98D2A091623B9628C19EB0A20979948FEAD5281700408ABE6D214C3AF7254ECFC7BFD043765DB22BF605476450553
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L...S..V...........!.....d..........B.....................................................@....................................(....................p..P@.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc...............................@..@.reloc...............`..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):89144
                                                                                                                                                                                                                          Entropy (8bit):6.182340209225805
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:uimVVOWFbLpAEl6kh7lqFVH01wwoMRocH22fzBaTT8P0gYagU7SBPO1Tx9K0MeKR:XmvblAch7FhRogkc57SBPoTx9we
                                                                                                                                                                                                                          MD5:5F644B9B95942D0B2DD87A0B62C44242
                                                                                                                                                                                                                          SHA1:358C9A3CCF3E337B80D6C83A03D4EF0332121B39
                                                                                                                                                                                                                          SHA-256:8D4DB964142A347B5FCFF3F0A5F7E7B7611B01D043C16265BEB19E0AF3C6BEF4
                                                                                                                                                                                                                          SHA-512:B90719D0BE398DEA7831182BF85BA006FEF7DCCB4C4DB2C97A113D0E8E8D3FF0D724BA653E8A8CE6FDF96D9C28F1D0C064701E1F2506CF1EC4589EF85D51109C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................P.......5....@....................................(........}........... ...;...@...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc....}.......~..................@..@.reloc..r....@......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\deepscan\dsconz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19129
                                                                                                                                                                                                                          Entropy (8bit):7.989274690937725
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:dAG4SpbwEKYAbje8a66SbGYQoYtIglDTuREcPJ220NZJwQ0kwS:RbSj0SbDQoYZlDT9cPJi1w+j
                                                                                                                                                                                                                          MD5:5C597E1400ED2E53A0BA2980497F415D
                                                                                                                                                                                                                          SHA1:04A780FFDE24174E5938B014B48BD3A522F77013
                                                                                                                                                                                                                          SHA-256:B8FF6DBAC771A71E1F927776685B59B5D9C84B7F17C2197612A2067419E9EB71
                                                                                                                                                                                                                          SHA-512:17C5B4E99BE20447EEEC010D2B7612A0FDB497E82EA549AE8E52357C7403B25F924EF8785D2435CCE77C6AC5F5AEA7DCBB5F7203A28BF930DF58119B93B87F08
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............}J......0M............L................LLLD|.HLLLLLLRLEL.... ..{.....5lG..]jo.{[T....._.... ...B.+C.|..D^..H..R`.I[...BM....9.~.x.N31...pK...U.O..''z...w...XA...P...5X..nP..$.DdP<VdF.`d.V...&....h.y.b]7..P}...~..3..3...[c....1..s...[............j.....P.v...i.H.t......d.4.Q.V.KJ%......q....j+.3...b.i..[.....8...Sdy.....L81Dw5.9.%...9...5..!yk..H.IV...6.q.VW..G.3{&)E..{. ..v|K$.....E.gC@a...<t.....cy.4...~..r.$bH.Y...L...F..gN..O....6p..We..N...r{.9..;=.%..O..%]=..J.Y=#...//U.=>...F......G^........p.........c%.a.I#...G...8..8.or......!....o.S..6...L......1.c..CM.m...R.^.[:.@.0..6.j.v..A..#.&..+-..C...E.}./T...>...F......C..A...<^k.{Q,.2xaU...C%%U..m.....<....D....@.~.p......D...=JJ..q.G@...It...TI...?~.._._%5...L......ns.Y..k.....g..............XW7..CzZ9....ce@..M.....d...H9qB..J.%.......t...(.t.....5.i.2h).jK[.B3.\U.hW...aR.....sN.>..B.I:...n...3.U'.3.2.&......%-...dSM.,.Zx0..G7....myc....l...,.=.;d..f..l..|...!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):61841
                                                                                                                                                                                                                          Entropy (8bit):5.571407723320333
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:LAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAM:lM4A6UAHRHF4aId
                                                                                                                                                                                                                          MD5:F4F74F2A95397A7638D79D6F4F6B86D5
                                                                                                                                                                                                                          SHA1:68EEDF5BF65727E96370199961C545000A62372B
                                                                                                                                                                                                                          SHA-256:85A90892FEE31CFC6FA89CBEA786BB8C5BB2ED4F5307BB824C990552F8163BBD
                                                                                                                                                                                                                          SHA-512:0590D6E65A2335A577FB70A6A2639C30D0B3CCDB3CCFE9AEAEDA792DB1C434709CEB2CBADD2CE9819F5A1457E1F3C3B51C5E2AF2BF63E67AE5CF37C229E11448
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............U.....?.................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25664
                                                                                                                                                                                                                          Entropy (8bit):6.551203472333642
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7rBoh34dYpfF5mkhI76eR3KJ1MdN+nDGPhCYtov05MQ3i:XE3/b5mxb9KvMuDGZoP
                                                                                                                                                                                                                          MD5:F5D9198D84038672A4A119D6ADD27A7A
                                                                                                                                                                                                                          SHA1:42694ADED31F34C8762FE5812D56B0DAC085F773
                                                                                                                                                                                                                          SHA-256:2A946888F2B719EB4778D8F8D6DBFF2FB13BC45F95A1EA9D664B822D730C0023
                                                                                                                                                                                                                          SHA-512:B93ECE2D26E00DEFA1F1A6DD4E29F918700A97F3056515925CEFB04383B72D491E885F8A1974DB04BFE7703F15E551710A392D6CD1CB8132707A849063CDC124
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........(...............................................P......=.....@.......................................... ...%...........,...7...........................................................................................rdata..y...........................@..@.rsrc....%... ...&..................@..@............. ._........]...........RSDSW...MJZA..@..C.T....C:\vmagent_new\bin\joblist\503376\out\Release\ru\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49272
                                                                                                                                                                                                                          Entropy (8bit):6.376071775747257
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:Hy2lF/WFLLpAEl6Zh7laV5tj01GtY+6JWtdvABBCvLEi:S2kLlARh7LjJWtdvABBCvLj
                                                                                                                                                                                                                          MD5:64BB678AAAAC9DC49B27E0EE51E450F0
                                                                                                                                                                                                                          SHA1:9842A78AD64FDDFCFDCE0A4D5997BC6F318327D1
                                                                                                                                                                                                                          SHA-256:F84D50E6794CB64F396EFAD821384F7FE4789B8BB5355593F9B5679A65280F14
                                                                                                                                                                                                                          SHA-512:FAF59680C12C5E349731675075C130394E372C60BF3D68C16190E3F2AFC754CF4A5A3AD5A1FB1204202C084D87B1D21A93B462D0E10DCAF06DC90E46EBF5BF46
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...].U...........!.....d...@......B....................................................@....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):47736
                                                                                                                                                                                                                          Entropy (8bit):6.071802511211324
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:CXHGdBPASgYoH6dzSnq5TmtzG3TpMtaNV8J8lAoKrt7hNZbxMu:jASgRcSqNmtzG39Mkf7APrtdNZiu
                                                                                                                                                                                                                          MD5:66B643F6A1011AB7F2C5BF97E493631F
                                                                                                                                                                                                                          SHA1:61E25EB3C4199D8E2F507A603F7317BFFD8D9920
                                                                                                                                                                                                                          SHA-256:4CF06C823BEFD0E5823A19FDFC1BD4F95C40BF93D89D943A91884380C5359FB4
                                                                                                                                                                                                                          SHA-512:FBB903CE5A090BB87BAD67B1F064BCC81D19CB40C09F7DFAF17E3041E0E2DFD59570DA65600D091989E4FFB526053D79E0BC484FD4B303142FDF05245B5517A1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...Q.U.........." .....Z...D............................................................@.................................................`...(...................................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21472
                                                                                                                                                                                                                          Entropy (8bit):6.581493877803118
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:78X6yAJHKTLCQHr6ki2cP0iwfLT7ZS+ShjmM6IGBkSz:IXpPiQm2cPfwbZS+ST6nk8
                                                                                                                                                                                                                          MD5:F4CBF84ED11EBB1FE9D804D1B8E6D007
                                                                                                                                                                                                                          SHA1:13DEC48089C68D6F3E2FB497F729405AFE952A0F
                                                                                                                                                                                                                          SHA-256:3FF09F39063213489CE9AD9FAF96EFAEE087F93CDE6D8F485FE48E993CDB03B0
                                                                                                                                                                                                                          SHA-512:3CE9664A76DCDA6F00499EC7FE963ADDDC628AC60E2628EEFF25A1DBA0339E39DB61CE104B40AB112B74B1FF845CEEE5E05ACEC8161B16BE902447EA594EAA55
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........&...............................................P............@.......................................... ..."...........*..H)...........................................................................................rdata..r...........................@..@.rsrc...."... ...$..................@..@.............#pf........V...........RSDS....y..G..dF.M......C:\vmagent_new\bin\joblist\815456\out\Release\ru\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\appmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):33628
                                                                                                                                                                                                                          Entropy (8bit):7.98732204286456
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:9XBAixRLCdOisVicqRJbxSFQfytJFPmLhpLgWCVwBMH4:9KixZwcGhxSFQfEFPmLhpmVwBMY
                                                                                                                                                                                                                          MD5:0FE58ECA7CE1AC206BD0E13D3E3DDDC8
                                                                                                                                                                                                                          SHA1:9293CD80F99601CC8B97752F20E51B582EEBA128
                                                                                                                                                                                                                          SHA-256:B0211AA8C33A8668D1C4DF05548EDC8E895EB0EA91EE4C0FBF4037B21A39A133
                                                                                                                                                                                                                          SHA-512:6BD18C7C26A3DAD8202892BF94EA1565F57CC24BF7C6936613E29C3EB502CF45E9EF1CB4D8B7FAA4FC2CF210E45C7EF9A53F54B7968E95520106D35840BD1D8E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5..............................................[..................................................................a.p.p.m.o.n...d.a.t................................................................................................................`.....f.3..B..tX....K{c..>.\.. ./r[..q"f.t..Kj\M.U.Y...WL/sP.T-.V.4.Tp......].V..&.Y.. H.J...C......`...(..7....u......#..w%..w.`...0....$..............0............$..*/.gz.&;|=. ^4.e9..,.*v...0...oS!......7Zg....H|K>....wG......}..'....S..Y.....6L.Y..,....4.-v...BL...p..;N.4..CUb(.M27,..Q)v...K.y......O..]s..X._.N?.WJ.$M...3.I4.v.7.C....6.A.....zs...."..[..$)m6XZ.JS9.R.q4..xF..S......k.....j.#.kz.V..'.t.........g.a..n...a.r..S..A6k.u.f..f.f>..-.c2.w7...N.R....Z....}..i98/"..-....../{0u..~...M.\2m..#Q+......!..^x.S.5..j..F...?%8.........;.~=Hk.fiWi....P.)...\h........I....$.5...=..'..k[\.5..N.]5O...8v...d..$u......).`...4c0Ok.>..5.oAi..{...].).H...I..#.j......'.Y.N5u2}..U.!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19936
                                                                                                                                                                                                                          Entropy (8bit):6.7020660700598285
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7vmHdlel+9l8Y/jHN6ki2cP0iwfLQdjnS+ShjmM6IGBkSbM:7mHdljFjHI2cPfwyS+ST6nkMM
                                                                                                                                                                                                                          MD5:E02A488FD0CE23BE5871607C5AF12991
                                                                                                                                                                                                                          SHA1:5D0AEBD59DFEB9CCCCA6EBE6CD520669D7EB4570
                                                                                                                                                                                                                          SHA-256:866B58AE4AA1E67194EF16828D5AFB483F6074471790ACD23A04A7D127AE9C49
                                                                                                                                                                                                                          SHA-512:D4ECC25D3769DD0657DEC18403B5C1CA63F839FBC7AFD5D2930F0892E7EA53B5A145A5E56D073F0AC52A67E0BD0F40F6A1AEAD930420046A18F174E51A79F99F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!......... ...............................................@......et....@.......................................... ...............$..H)...........................................................................................rdata..u...........................@..@.rsrc........ ......................@..@.............#pf........Y...........RSDS.x.5f+.L./..-../....C:\vmagent_new\bin\joblist\815457\out\Release\ru\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19148
                                                                                                                                                                                                                          Entropy (8bit):7.973798997238837
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:SAq5k+M6ZcBdg4bI54pee8DftFwgaHc4r6u/o2ATmO1qNC5YhVZXCXLz5kc2obPP:dabKpHyFSl6KMTN80OVE7dzLqyIVZhZG
                                                                                                                                                                                                                          MD5:D885D1169D6F534DBBDD039A7B7B15DD
                                                                                                                                                                                                                          SHA1:43F6AD484B0636EADAEEAFDCD440EFCEAA2D13D4
                                                                                                                                                                                                                          SHA-256:D419B4851AF4636EF7E167BF6DD5B35BA33C16C5A783E6DF993247EB1CBDC407
                                                                                                                                                                                                                          SHA-512:4E0C6BE3A3C8054BCDA5611CE6D8737D11042565C9D5750C70458C99230DD2E9D4D23F9C60A4EDADE0AD9A15D697708EF63B74AC8FED4592539725B5D388782D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5................................................................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................&..uO...J.,K...M.{...g.,CP..O..-z.+..4u$..c.......F)....boh.V`.PYz..K-..[...s....Z.w..._...c.....'.lNQ..p.i......r....t....#..w%..w.`...0....>...........+..0............>.0....%....8ad..i.6IQ5.R.s.....$u*C..........L..Z..n.L.OU'j./49hy.....d.J......LT.h..zq.....\.E.B.....X.);...x>N.A.......}u..?...J.3/..*...G]..ZQ...>]7.vg8.Q/.5M..V............C.m..e.|?\...P..v....#.a.....Z..m.0.,.......H.n~....g.h.&.0..]m.......2&.g..K....Z.............p....L.6.U.L/...4....IT.Q.$...Mi..Q6..'...,...q.-G.w...S.....@?U..+.On..d...sP..R.k....*.8..P1.Qy..l.....Y..h.Oi.m..]."g..Y...N.......aA.....w5E....yajt..G.f%Sx...f..~eu)yT..1F.............n. .".E.mGG..p..5.L.:3.W>..Y......V....Z#.....s......4.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):35692
                                                                                                                                                                                                                          Entropy (8bit):7.9868833291780374
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:Otq6y9CkYzdVYwjUh/1jERZtmWk30ctHcMUy5p4aopIGmx4bHbbt2:Os6y9oTYUUh9jEDkWk3AMUEumGUEHbh2
                                                                                                                                                                                                                          MD5:1E2094F78C8643797B1E8E1C645477F6
                                                                                                                                                                                                                          SHA1:7BF71A8733485003438485CB5CCF60ABBA1F629B
                                                                                                                                                                                                                          SHA-256:3C9759A144A6C0537792D280CD0C58E3D9389B24FF3957DE6E83BDDB9390E357
                                                                                                                                                                                                                          SHA-512:162DAF847778B774E19847949B04D2F5C06E13021533081DC215EBB7201D7BE31E9BF843D55A2858F2B1FA037157618F53C4A3E40733F75C555223FE60FBF18C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5.............................................$J..................................................................r.e.g.m.o.n...d.a.t.............................................................................................................ya.....as.e..|9..Y....z..B.^,o.l.h.M.KO.4....Q.~..P..I..s.9$.X....3..... 9.a Xg..,#........x......8.(.....:Y....{...B.f..[....#..w%..w.`...0*.4.........(......0*...(.....(...uR{....I.S...z....O.....`..v".b..73.`...u.(.u..$.0....L.5E.N...J...U.dT3..).S.$N..0..j8.....o;{Q.A,.4p.X.....`...;.y.\.pvtc...'aDFD].......L5...L...Y..;...\.0........W.d.z;.1....I#.l.<.![C........(.N.C.z....8.......#..\...x.QX...M.P.....O..>..j..Q........o-R..1.d.\.5a.Qe..u.&.2U#.......?<.y.fD..y...[..B@.......?s...|z... .{+.. ..........kv.`..m#G..:..4.M.4.r.s.J5...T...`...qEn..<n..U...."0..E.R&S..o...eO.h*...V........].....p.V....S....Ie.....!.........Y.....q`..].z..<.YA.t..u...;.Zrm....V...."..]b...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):6.9687564739593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7nIfs687e66ki2cP0iwfLYWIS+ShjmM6IGBkSuKl:cE687eV2cPfwyS+ST6nkpKl
                                                                                                                                                                                                                          MD5:26AA3B48669EEB1973FFD8545FD46629
                                                                                                                                                                                                                          SHA1:A83858F61606D7E7B274E21431F0FE97951C3DD3
                                                                                                                                                                                                                          SHA-256:107CDF366850EF175D1873BF49820218DBEE748AA81E2BFD5442DB920238AB15
                                                                                                                                                                                                                          SHA-512:966C48A529EA82C20B8F50DAF5285B120FF04D54E81444411D144F78D9A94B3B911457231EC7A1802313072519CBF52F94F9B45E96EE7DF55E68EFB8348F85D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...`frf...........!.........................................................@.......t....@.......................................... ..d...............H)...........................................................................................rdata..t...........................@..@.rsrc...d.... ......................@..@............`frf........X...........RSDS...%.U.F.Y.'........C:\vmagent_new\bin\joblist\815994\out\Release\ru\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1065, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090560
                                                                                                                                                                                                                          Entropy (8bit):6.841525417687069
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:CMMZ8neD0oBlp23wYKba3EPVcgrVB8B3pXvcohXa:xndKp23Aba3EtcgzF
                                                                                                                                                                                                                          MD5:0B9C38B8319E762799690261C2030F63
                                                                                                                                                                                                                          SHA1:611DFE539F01A6EEA5B60E55201A723B9858C9D7
                                                                                                                                                                                                                          SHA-256:C19BF6537B6BD2889A49499C2DDE9F7E209C4575A79235176976A4A07E38197D
                                                                                                                                                                                                                          SHA-512:CB501266F589DCCBD40607D303FD5C763A04B2D8C5042D9FCE94634C96831ED0C5FA9D8845C3F16B0B58C465D7C443D5BD7E52826E249624FA58622A5371E701
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......).................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\libsdi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):104868
                                                                                                                                                                                                                          Entropy (8bit):7.998543621729682
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1536:xtHzPK/xdGrjOr3K1Sd5sVgg8IWU76HrrBWgOdjgPWO+LUp93ylak1OA2a/M:xhSCj830Sd5w8IB7Acwput7E
                                                                                                                                                                                                                          MD5:13645F85FAA870402C7692F02EFF04E5
                                                                                                                                                                                                                          SHA1:26A804E90D158C33990E0B4E83D1461DB85E8BC1
                                                                                                                                                                                                                          SHA-256:E7520D167B869010870F3C3599915E5F7B5B28F6CD9DFE05A8A0F2D0AA3F7BC5
                                                                                                                                                                                                                          SHA-512:D5B87E0AD00838AF12AB7B0980124AA533E8848CA3308F593193967C1AD91EBBA7EA57554F699868121F50E835342E196B8675E5942F8D18F70811C64E82F6D4
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.G.....*...N...HB..d5.M6..z[..z.v).....q...G....D.... ..V...S....b!t..z.....Si.C.q...4W.,CY1u.X.)d....WX*.....?...RJ`./....W..?....a?.5-g%>Z..........R....u....m..U.>5Z..*.U@..x...Yt.{@G....vl...z...bs...)..T^....5~$.1J.~.~WoOb.[`...jBC....5.a...-.J.]..<.DG....C}.t.L&.1y.Iz....A..JW.VR._!.5[..1J..1.......7.G3..>JM0G..G..Z.@.<!..$...\............c*}Q......T?y...M...[.C....=.y...z..Xf..|.W......v...c.....r.q...YyI@.'.8.....*......].l.af.9D.S...M.S#6..m...zY\....q..,.]e....7.0.......m....5.T..o.\..P.`</:...r._.z............N..T....9c..f..dQ|.r.)..)..*|..$.....}z.u.. {.'..X..8.)..v..6...DE......P.]..;!.;...(q.] .......;q..5i.m.J.......33j.b....HQ>.z{.d....CCl.Q..5...9.......ny`<.#.....G......b...X..~r.U.T>&..J.P..w.k.#.f..].3ga......t...n=`....\ET^].f...F..G....0(....@o.7...!..}...j'..>.b.........:..C]a.....w...-d.&.f..B..].9.C..n.`j....S;..K..#,.TyB..Y..1..<v....(...s .UZL....|o...uW.(...l]......%w.+%Y.[kV..yG.C."..`.8.........|..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007009, page size 1024, file counter 221, database pages 792, cookie 0x8, schema 1, UTF-8, version-valid-for 221
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):811008
                                                                                                                                                                                                                          Entropy (8bit):5.832144132410366
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:x/nCExkRpiJhfKNJhvVdTTOfPd/mSuWNs7/wQH9jX:RCExkRgJhfKNJVHMPJmSuWA/wi
                                                                                                                                                                                                                          MD5:2B45B876D082AE05133588688B93D2FC
                                                                                                                                                                                                                          SHA1:7A9E2D9DDDB88B7DC7568FF1DA03CAB24CCD9CE9
                                                                                                                                                                                                                          SHA-256:769549522693FD235DBAE7F245CAD07980F2F9F8FA1E93365A5113D00A25E59B
                                                                                                                                                                                                                          SHA-512:CBA77CB63201D2E14C364F369E2B4619D0926F8AA4DD6281925CE1B435209723250218BFA9067176967271E9876BEEECFAF5BEE236CA3C9038315C515C94D22A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.!.......................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32584
                                                                                                                                                                                                                          Entropy (8bit):6.209704627462931
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7hmacsultAgwBAP3ExcizfbHUWgfMCPHz7eMLm:Qt4B23ESYfzUWgUGm
                                                                                                                                                                                                                          MD5:B73A74EBF7C30079DBB1D1FCB370C956
                                                                                                                                                                                                                          SHA1:53AD86C8FBA9D243FC19F489891DE9553E7FE20B
                                                                                                                                                                                                                          SHA-256:D28C965F553A41D8B545A7014FE452D6010818637E06C595541815FD68D4F781
                                                                                                                                                                                                                          SHA-512:CC2BEC0289240D5165E8F83B412167A200B6B900B98C318A15D19DFD24FBE1DE00B343969574A8BBE40767AB2B8DFCDE38863A512D29F75B370D85ECC41C3B5F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......S...........!.........`......................................................@.....@.......................................... ...\...........d...............................................................................................rdata..............................@..@.rsrc....\... ...^..................@..@...............S........w...........RSDS..C.[.I.chI9.HC....D:\Projects\SafeGuardIntl\branches\SafeIntV3_5.0\i18n\I18N\SPTOOL\RU\Release\360SPTool.exe.pdb......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1940
                                                                                                                                                                                                                          Entropy (8bit):4.153480011802863
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uNiwLeje2e+Me9e3geFde2eQ+MEeWAeX4O:r3N3G0n+RqO
                                                                                                                                                                                                                          MD5:9D3C7E05F55B00748BED46B059D46ABC
                                                                                                                                                                                                                          SHA1:564387F3617EC07ACD778E61320F44C8EED5F2BA
                                                                                                                                                                                                                          SHA-256:56D60AED3E6E0FA042A407F4EAF2683981173D5E23917734F4A127786A81D938
                                                                                                                                                                                                                          SHA-512:0368AC298E4FA6C801CED43FF5057C4E84B8C63C1D504F70BEC6657513AEC788CF893C2019299325CB98F53B3E3F30A668148A905C6827F294F7516B4434C67A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=...@.>.3.@.0.<.<.0. .>.1.@.0.I.0.5.B.A.O. .:. .2.5.1.-.:.0.<.5.@.5.....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=...>.4.>.7.@... .?.@.>.3.@.0.<.<.0. .A. .4.>.A.B.C.?.>.<. .:. .2.5.1.-.:.0.<.5.@.5.....I.D.S._.T.I.T.L.E._.R.E.D.=...1.=.0.@... .B.@.>.O.=. .A. .4.>.A.B.C.?.>.<. .:. .2.5.1.-.:.0.<.5.@.5.....I.D.S._.N.O.T.E._.B.L.U.E.=...A.;.8. .2.K. .=.5. .@.0.7.@.5.H.0.;.8. .4.>.A.B.C.?. .:. .2.5.1.-.:.0.<.5.@.5.,. .@.5.:.>.<.5.=.4.C.5.B.A.O. .7.0.1.;.>.:.8.@.>.2.0.B.L.......I.D.S._.N.O.T.E._.O.R.A.N.G.E.=...1.=.0.@.C.6.5.=.0. .8. .?.5.@.5.E.2.0.G.5.=.0. .?.>.4.>.7.@.8.B.5.;.L.=.0.O. .?.@.>.3.@.0.<.<.0. .A. .4.>.A.B.C.?.>.<. .:. .2.5.1.-.:.0.<.5.@.5.......I.D.S._.N.O.T.E._.R.E.D.=...1.=.0.@.C.6.5.=.K. .8. . .?.5.@.5.E.2.0.G.5.=.K. .B.@.>.O.=.K.,. .2.8.@.C.A.K. .8. .2.@.5.4.>.=.>.A.=.>.5. ..... .A. .4.>.A.B.C.?.>.<. .:. .2.5.1.-.:.0.<.5.@.5.......I.D.S._.I.N.F.O._.A.L.L.O.C.=. .0.7.@.5.H.8.B.L.....I.D.S._.I.N.F.O._.B.L.O.C.K.=...;.>.:.8.@.>.2.0.B.L.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):109056
                                                                                                                                                                                                                          Entropy (8bit):5.42491617980814
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:pORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3H:pOBrUC4jyUJGKzgSg+se08GD0FS
                                                                                                                                                                                                                          MD5:6E15038DE4F4BF0C6C533582BBC1685A
                                                                                                                                                                                                                          SHA1:C1DF2F1EA4CEF5BF8074A160CF2D7349E0EDD223
                                                                                                                                                                                                                          SHA-256:5404274FAA61A9E6D27538AC9E60E380D49112E7D83AC40D6BB5B361F22FD4C6
                                                                                                                                                                                                                          SHA-512:21FF40A46826485D9385CF42F2FDF8E2E821A4EE9FAF6B98B30454E640918912F30777B929FC9A41B1BFA089AA5778FBCAE63097C95D583BF894245DE0B86EF7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........n......................................................*D....@.......................................... ...j...........r..h7...........................................................................................rdata..............................@..@.rsrc....j... ...l..................@..@..............2\........w...........RSDS.3.A..lH.l.bo(......E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\ru\Release\360procmon.dll.pdb......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\Safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54392
                                                                                                                                                                                                                          Entropy (8bit):6.321562631017079
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:7CG11xWF7Lp/El6Eh7lKlL01H+6JWvMPJs0lBAxjV3:mGa7l/8h7D1JWMq0lBAxjx
                                                                                                                                                                                                                          MD5:281E48652ECE01F31507279C24ACEA71
                                                                                                                                                                                                                          SHA1:62788B0564A87DFA01793BF5A5BA0CE9E421E0F8
                                                                                                                                                                                                                          SHA-256:74B367520B64A7466D444F973E3311BB60157982783985993230E899BD47F1B6
                                                                                                                                                                                                                          SHA-512:9AD3AB3A8155C6C68D2F5C3D8F7E9D330718960EE85C5E2CBF53E41490F28E84913B2C7A54B81AAA914F4722A0E598CA7AC8AA6C366AC4C9629AAA465222E456
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...:.U...........!.....d...T......B.....................................................@.....................................(....... ........................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc... ...........................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):53368
                                                                                                                                                                                                                          Entropy (8bit):6.011685502315887
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:O3v+tnPKY4PWWYzpnD9UT1tFGHXjpjqEVs/rfroLoQMPpE6yfh:9KJSpD9+1tFGHXt+2yrNp/yp
                                                                                                                                                                                                                          MD5:02F38553BDE1E32A58B800A10AEEC0DE
                                                                                                                                                                                                                          SHA1:8D109BF9A08B06F7496566218E32DC90919E82F6
                                                                                                                                                                                                                          SHA-256:9578DE832C4768DE9B2CE813FFA989096FF9BA586A685B0D699EADD90958AEBB
                                                                                                                                                                                                                          SHA-512:687A2D44954C646D7A33F6910E0533BF812503327185F2EBB74273CCB04514E3B0FF1C12376D8C09BA1F3D08026681AE3BCCA76F7DDC0FACB7C772D2350B96B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...{.U.........." .....Z...Z......................................................=>....@.....................................................(....... ...........................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc... ...........................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):6.889707422562667
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7YYgIYkAI70HVJeMqSJvHlVSQKvrfpMQ3Uy:UYg9kfQ1s0vFVSQwKy
                                                                                                                                                                                                                          MD5:65B3D8267604933B155C9C5635118A0E
                                                                                                                                                                                                                          SHA1:61728EAB4D4212F7302DC9EB705EA53FA089A6AA
                                                                                                                                                                                                                          SHA-256:F1AF6BD5576F5F5268937182CD6248B23B5E01F6285375764E761D250AC0BD47
                                                                                                                                                                                                                          SHA-512:E3C8CCE984A02D757D4E49C64684B90DD62304A43CDE84F3AECCA6BAFA718AD857D88150768DB393B3C92F05DBE9755547039142F81B7B5475B36C927A9D4BEE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........................................................0......./....@.............................................................h7...........................................................................................rsrc...............................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...............................................................................................................................................................................................................................................(...8................................................ ..D...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.125278740556996
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7qgB60TZHrOI7nOSeMsdGjxEA8nQJ+MQ37a:GgB60TZHh5qAnJMa
                                                                                                                                                                                                                          MD5:967E6A65955C40454DC619FE93CBD0FD
                                                                                                                                                                                                                          SHA1:9725FA4B7BED5821DA4F1908FD28F5B58BD9D882
                                                                                                                                                                                                                          SHA-256:6E88CD943736A938749DD920A8A93A44D0EC9928FAD4C3E33DD2858F90DD8452
                                                                                                                                                                                                                          SHA-512:A21E242F24730532DB2A871819E7FB831BCFE81881BECEF7A5618CDDE84A76D86A13576CBEB204938C7934F4187928C2E20193E73E8F0154E83017D22264F092
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0............@.......................................... ...................7...........................................................................................rdata..}...........................@..@.rsrc........ ......................@..@...............[........a...........RSDS...)`}lB." ...*`....C:\vmagent_new\bin\joblist\259671\out\Release\ru\UDiskScanEngine.dll.pdb............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19512
                                                                                                                                                                                                                          Entropy (8bit):7.010856474089151
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7tU7OeR3K+h1MeK6j3KDGPhCOov05MQ37:xUP9K0MeKgaDGpo
                                                                                                                                                                                                                          MD5:3CB60A42574202CB0DC2DDC053275E12
                                                                                                                                                                                                                          SHA1:53E3F3FF71BBD6833A817F4DA8250955A6940968
                                                                                                                                                                                                                          SHA-256:8FD17DB3AAB7028A6092CD60E56E788309FC4B075CAB8E4D5CED6249CB6A3CF3
                                                                                                                                                                                                                          SHA-512:AFF52B9C7031EBE23A3EC515D5C28A8BB338FAABEA8CEAE3A7ACA61E1C9BB78AE774C3A990D679150C205D9709BDDDFA772575A583F237C53F6247066601FAD8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... .......k....@.............................................T................;...........................................................................................rsrc...T...........................@..@....................................................................8.......P.......x...................................................................................................`... .......................8.......................P.......................h.......................x...............................................................................................................................,...............8...........T...............................................\...................Z.............I.D.D._.D.L.G.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.819587489701495
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7ILLtyLqsMs92lyMrj1grjzR+vnr9ZCspE+TMArRwWUV:7IL4GsNU8M8z7eMHWg
                                                                                                                                                                                                                          MD5:9DE978AFDB84AE279774398CDF20A236
                                                                                                                                                                                                                          SHA1:2CE89CDACB11E74D3D59548B5AC698750312D93A
                                                                                                                                                                                                                          SHA-256:E2F6FDAD4E7704EADFF089096D6943B3D0DB3D44AFC50E2A996AAE4156D379D6
                                                                                                                                                                                                                          SHA-512:49EC6956F709D6B07E5550923C33E455B97D31FFD6CF860504ABA7F3FAC5822E5B1C4C8F1CDEDCD6F2778C1D456E676D09838A7C2D093A5E4EB24C8CE9893CF5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ............@.............................................l............................................................................................................rsrc...l...........................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`..................."...........0...................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./.....@.0.C.7.5.@. .S.p.a.r.t.a.n.....@.0.C.7.5.@. .M.i.c.r.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.74566585645716
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7XLLtyLaMeWsEE1yMrj1grjzR+vnr9ZCspE+TMArfeXd:7XL4uPjMM8z7eM7d
                                                                                                                                                                                                                          MD5:D732603FAF94C5B18E0CAA1B2DC3B2B7
                                                                                                                                                                                                                          SHA1:107929A78AEAED846EB7D083735710BE407F6245
                                                                                                                                                                                                                          SHA-256:29378231A3289E542FA439EB8D100EC230C97E56BC36BDF4ABA274F692DD4692
                                                                                                                                                                                                                          SHA-512:3DCB6A61C83A8F50D5696CC7887CF75301CDE80F1C8CA13364ECD8E00321BB1E8451DD74D9DFA835218D09BE71D0AFAF964CB6637EDB162E97D9F3F4D3E8B2B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... ......c.....@.............................................................l............................................................................................................rsrc...l...........................@..@....................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`..................."...........0...................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./.....@.0.C.7.5.@. .S.p.a.r.t.a.n.....@.0.C.7.5.@. .M.i.c.r.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):490
                                                                                                                                                                                                                          Entropy (8bit):4.138748918308294
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Q++ubxoBn0GQdDiCbhR4rBmgEbks8E9u9a9GCbE9Wksl:Q++u+aiCvvkuu9pCCWk0
                                                                                                                                                                                                                          MD5:B0E5831D4EB52321E0B3BFF79BCAFA21
                                                                                                                                                                                                                          SHA1:C18643B132E947C87BF616F2EC9539092D6C0B1F
                                                                                                                                                                                                                          SHA-256:066ECD6D3625F01BC645FB345CE93FE7724AE49906143C671A7EE1766C65DC13
                                                                                                                                                                                                                          SHA-512:3285F31815189905CC8DB4FA9CC7CA7BBFD7B281FC0D1AD31A1C2B6B3C8924E99000A4A59CDFE333BE715F44D14A5C8401E0BB8C47166721C578805FA78DA6DC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=...G.8.I.5.=.=.K.9.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=...>.4.>.7.@.8.B.5.;.L.=.K.5. .D.0.9.;.K. .8.7. .U.-.4.8.A.:.0.....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=...G.8.I.5.=.=.K.9.:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=...>.A.A.B.0.=.>.2.;.5.=.8.5. .....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.!.:.@.K.B.0.O. .?.0.?.:.0. .U.S.B. .4.8.A.:.0.....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=...>.A.A.B.0.=.>.2.;.5.=.8.5. .:.0.:.:.\.n.%.s.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8534
                                                                                                                                                                                                                          Entropy (8bit):3.6756208021710233
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVlcCENqWIajewapG4Y8nc7WabJ1J9W16AFWbmc:29+DgRgEBz8G4Y8n+WHFWT
                                                                                                                                                                                                                          MD5:05A1E5F352E4BC7ACAE74B7357739EF4
                                                                                                                                                                                                                          SHA1:2B5C921C667854340DEE64A4593A6433B929304A
                                                                                                                                                                                                                          SHA-256:76B25C06EA617440A76FFACB68B27767D5925F262455D0BE35F813BBB2C4BA37
                                                                                                                                                                                                                          SHA-512:854BAD66F4FF2D72903BBCA5CD67605A71793D7B0AA9B4C1268DEACC8BD68742C3D6B7DE49243E3E8A59166F97DF9F480044B97BC11AA9BF30A4B0E43A036276
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.3368784455043783
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsSg6PCabR:r5u5/+mMks5qTp1mNqce9OoJ6aabR
                                                                                                                                                                                                                          MD5:9AA94B6E19B89B8C2530C2506BCED7CE
                                                                                                                                                                                                                          SHA1:BC3612560F1D5B68C289C1338450E718038F4A9E
                                                                                                                                                                                                                          SHA-256:9641699D61162380DF6345E606671A0AADF24AC61089462FAC5502D5A48B0BF1
                                                                                                                                                                                                                          SHA-512:6E1D11B466E922480197C9DF764182FA5CA4EA2C925DB8199CF659372A37846D6954DBCF5C597A9D15B48B80998F9E4E375D1C0F61BF1BF5C8D693B43BFDB3B5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\ru\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10568
                                                                                                                                                                                                                          Entropy (8bit):6.8599562301794155
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7E+FnVygH0HWlyMrj6Pu7CrjzR+vnr9ZCspE+TMorFZ+mf1Kyq:7EUHi/MCPHz7eME+mf1Pq
                                                                                                                                                                                                                          MD5:2CCB1135A31D4502CFF25D0E53DA89E2
                                                                                                                                                                                                                          SHA1:2655FE1AAF729F8BD018C46E31AE17A0C43C2504
                                                                                                                                                                                                                          SHA-256:7DE00BBE491EB293E5E55E3A9F2C15E7C1327B48F8C25F0045682A56B9CD587D
                                                                                                                                                                                                                          SHA-512:A05432E161DCF79AE62B5A3324E19AAB724D43D2927D24C076C987C88003A5CEAF84C310B2AC3333A0EC298E50021FE622EEB89143737E06E5D4037B8EFCAE19
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......S...........!......................................................... ............@..........................................................................................................................................................rsrc...............................@..@....................................................................(.......P.......h.......................................................................................................................................................................................(.......................8...H...8...........................0...................x...........@...Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.f.o.x./...@.5.@.2.0.=.>. .%.s. .?.>.A.5.I.5.=.8.9. .%.s. .[.2.@.5.4.>.=.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):133696
                                                                                                                                                                                                                          Entropy (8bit):5.310069089375547
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:7b9RoAp+Xd48W3KKPFW4eMyUeFUiaxy7twnwzaA7BR0/Pc33utjK3S6vDGTRMNwr:dtnD
                                                                                                                                                                                                                          MD5:510FC87798C049BCBDD97BBBA74BAA01
                                                                                                                                                                                                                          SHA1:CA819B97DADA6EC91F28E884439B1DC01907D7C8
                                                                                                                                                                                                                          SHA-256:036BF153E4A600DD5FA574B89EC61701C129F24CC93A5EF45B4A56B6CE8F25B3
                                                                                                                                                                                                                          SHA-512:4F6FEC150688FCB7441B74DF47764B3352A177E90415BA33C469C7BD1F8E832A77FDBC00888D48C671D9F568D637BF9AD7A43D513E9FFC35378A72187F11BEDD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......[...........!.....d...h......B.....................................................@....................................(......../...............7.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc..../.......0..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1716
                                                                                                                                                                                                                          Entropy (8bit):3.781254538034536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uLTlVf7rs4humKaBrWP6G1yY7IT3q9HeB9S:r3LTlVf7rsiuwo6YyY7KqZc9S
                                                                                                                                                                                                                          MD5:C35843A2BC3F6103A16154B9D2BB4748
                                                                                                                                                                                                                          SHA1:0327B9D3B66EFBC964FA20793ABBD5553FEA8BBB
                                                                                                                                                                                                                          SHA-256:37B16E32E737BDD1B49DCC5F3F6E477CD3BA8F6F99487FE0D7EF0E1ED75207B3
                                                                                                                                                                                                                          SHA-512:87B5B78C831BA2D05D2A795CCA964C858616C57728007515BFC15B0CEFA1564F5FADC92757800A08BA46CE46E1F4AEF5F9E5838AF2D192A334604BD1051E4708
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y. .H.a.t.a. .R.a.p.o.r.u.....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=.c.i.d.d.i. .b.i.r. .s.o.r.u.n.l.a. .k.a.r._.1.l.a._.t.1.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=.N.e.d.e.n. .o.l.d.u...u.m.u.z. .r.a.h.a.t.s.1.z.l.1.k.t.a.n. .d.o.l.a.y.1. ...z...r. .d.i.l.e.r.i.z.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=.K.u.l.l.a.n.d.1...1.n.1.z. .p.r.o.g.r.a.m. .h.a.t.a. .v.e.r.d.i. .v.e. .k.a.p.a.t.1.l.m.a.s.1. .g.e.r.e.k.i.y.o.r... .K.a.l.i.t.e.m.i.z.i. .a.r.t.1.r.m.a.m.1.z.a. .k.a.t.k.1.d.a. .b.u.l.u.n.m.a.k. .i...i.n. .b.u. .b.i.l.g.i.l.e.r.i. .w.e.b. .s.i.t.e.m.i.z.e. .g...n.d.e.r.m.e.n.i.z.i. .r.i.c.a. .e.d.i.y.o.r.u.z... .Y.a.l.n.1.z.c.a. .b.e.l.l.e.k. .d.a.h.i.l.i.n.d.e. .b.i.l.g.i. .g...n.d.e.r.i.y.o.r.u.z. .v.e. .b.u.n.l.a.r.1.n. .a.r.a.s.1.n.d.a. .k.i._.i.s.e.l. .b.i.l.g.i.l.e.r. .y.e.r. .a.l.m.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\LibSDI.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):98884
                                                                                                                                                                                                                          Entropy (8bit):7.998045999927852
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1536:+2kxMiHBkI+0vtDDz1NmIEJQWzhlul52Zetw3TyjwboRsUzE8Mj/jUFmRnH6ol:wpBvxhNx5WuHwPobE9oGnHfl
                                                                                                                                                                                                                          MD5:68E9DB7650C40C6D774EA5A815023BB0
                                                                                                                                                                                                                          SHA1:55CEB980E8734BED4C980157FA3F29687BE2F8CF
                                                                                                                                                                                                                          SHA-256:D34CACC48A36200F59601500682B82B6595906E4AE05E8EE0B1C566B487F7F29
                                                                                                                                                                                                                          SHA-512:BEF606E71F2CF9CF22C6ED4377CAF4DD2FDC1498A9AFD7701088283BFD7E8289BA5D3061029A3CC76648896D2175F02F41DB843C29FB45E39CC5951670517071
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:(...N....m.uv..6.h......qa...O.Y....#to..;T0...eS.?!.!.R!& ..r.j.2.@...a:..z....o.d-..vJ.....a.(3..(..K5>&..7|$U..G.k....L..d..pJ.....1..$.m....H.Q..L.)...%._.'B.v.L..cYC.&s.*.G+....qz.~..=.r.E.....'/`.....k}Q......T.a..\...7.k4.. j.|...;.D&.C...X..a.J.X...+.?A.HE....S#...%...fA.?.lc....C..^&..cA..d].b.....s".....d...g...X...W.d.~."...Y*..../..N.S/tt..]...#..|o...%....5...F#.%m9...^v^d...(.qm..U..n.Dev....N...K4.b67jRV.....R.y.~..B]..1.+....P..C.....{.yV...p4~."...M.zE........cv..[...D..?..45U*.g.Srb.Wa....Pq.rFs.#nIL....h.S]_..#3O.t.{..P...Q...!.@...a.....D2y.?...>i......n.;.p...`P..9..7...Z&@.F..7N)*..f. Eg4X<=.v...l.k../h=M..<..`A(...}~.......n.g+0....(8e|..M....^...c.zMu..d..'.......=...zdD..%c>...)q.\....9?Y.$..@{...6..2.d.*d.<.G1..g..M%...T..{@.g.h.F.b.ykA.....A.O.D.B.~R.mw.F..v"....=..`.h...>9{......7.(.yPa.p....xOf....p%.#..h..}.g.AQfw..o. .s..}....EPz.4.....n.[..dZ....b..m..18....\.. ..#.?w.....w4W-.c.F.i.tH...b7....f'

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.583385204920944
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7b1/tGKZmatDGAINI7nOSeMWzjvA8nQJ+MQ3/jLG:nVtaWDGAvWvAnJsjLG
                                                                                                                                                                                                                          MD5:54BFAEB52E3A4E20C1E01BE85B2A9B73
                                                                                                                                                                                                                          SHA1:C98A80EBC770F277AE8032F986CB0ECB3D9E5580
                                                                                                                                                                                                                          SHA-256:4CAFB7A2EEAF3B9FB80BAC8AD78281D194F46607BA9C5141700CD3548CA965CB
                                                                                                                                                                                                                          SHA-512:0FEF37D18A5A557A531F92D3C554281F0425AD183A77B384FDDAB7CBDFC4B0745BA3711D89D90DD3450A21DD508DF41B6EF5F29AB01E4029B87403485EAFBE26
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...O;.[...........!.........................................................@............@.......................................... ............... ...7...........................................................................................rdata..y...........................@..@.rsrc........ ......................@..@............O;.[........]...........RSDS..5.JrA..a...d....C:\vmagent_new\bin\joblist\258920\out\Release\tr\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):113208
                                                                                                                                                                                                                          Entropy (8bit):5.5277613104666115
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:sgjRoRXCNaJpQo3YHctPUwcCYrBnWE0N5mqN6XWEnp7nHJUi5MA+7ZhLCfq5Wi5e:nt9
                                                                                                                                                                                                                          MD5:0059416075D0C40064CF1D1EDA3096AB
                                                                                                                                                                                                                          SHA1:07C485D5A2D9D6B5353AAC614271374AAF546756
                                                                                                                                                                                                                          SHA-256:175C19B72B3C05D0B5424A0936E93AF7A4503E80D122271A3515FCF3DCBE5C7C
                                                                                                                                                                                                                          SHA-512:57B9C944408FD22F1CF55F9223C2FD95FC64ED6F097C9EA4965E68470A86421DF5314486D7D9C6670579A29AB8532E2CDF191CB10D81A92B2ECF4782B05E56E6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B................................................o....@....................................(....................~...;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...............................@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):105560
                                                                                                                                                                                                                          Entropy (8bit):5.3748571920297366
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:clYPFRoY7+0VLaJpQo3YHctPUwcCYrBnWE0N5mqN6XWEnp7nHJUftA+7ZhLCfq5S:e2XD
                                                                                                                                                                                                                          MD5:EDB0220B862394D234580C53068F7328
                                                                                                                                                                                                                          SHA1:6EAC07B93895D20125CBFBE3F7AC5FBA325AFD69
                                                                                                                                                                                                                          SHA-256:791EF4757D9B81D8CBD2E915266205D54EC7A23A819A89DC86548962CD661DB5
                                                                                                                                                                                                                          SHA-512:6C5CBC11ED7BE9066CC89BEF486BE3402005FC15B3C2ACAA1A5B160A6381D855807A4B6DFA6A8CFF72F9FE6EDD45DB753DE301DD42F92489EFC92311724FF052
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L.....-V...........!.....d..........B................................................5....@....................................(....................|.............. ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc...............................@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):92216
                                                                                                                                                                                                                          Entropy (8bit):5.856153882843827
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:jmvblAch7FERoXoaJpQo3YHctPUwcCYrBnWE0N5mqN6XWEnp7nHJUpwIzizlBPoA:j+ERo4aJpQo3YHctPUwcCYrBnWE0N5mV
                                                                                                                                                                                                                          MD5:DFE01FA80280426C576D5B79EBF5E2AD
                                                                                                                                                                                                                          SHA1:63540D325AC27C5ECF4398384E381750C03414FF
                                                                                                                                                                                                                          SHA-256:B891E2A06E3FCD4ACEEF10E5EA0FB2A14FDC302D9DBDF6B9130367A04144B6EF
                                                                                                                                                                                                                          SHA-512:728946BF92A72BA9BF6B0084112EA89DF6A1C21D912CBF7E0A6D658A8F44AA55D5256AA697E6D8940BA3397682F99126E06B75CF06F4D066FF130705A123BDA9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................`......2{....@....................................(.......8............,...;...P...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc...8...........................@..@.reloc..|....P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\deepscan\dsconz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19065
                                                                                                                                                                                                                          Entropy (8bit):7.989483184789938
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:PAG4SpbwEKYAbje8a66SbGYQoYtIglDTuREcPJTChE3w6BJuA2NpD:3bSj0SbDQoYZlDT9cPJyE3vBcAIpD
                                                                                                                                                                                                                          MD5:56AABE314651B7CD647C7B7EE1963013
                                                                                                                                                                                                                          SHA1:9B51057D57A5805038B3DF7AE89E026D367AAB3A
                                                                                                                                                                                                                          SHA-256:333C5D13DCD06240E40749A72743320C05CA708BD18D4FB1A2694863D562BCE9
                                                                                                                                                                                                                          SHA-512:BAA1113FABB703F64B0C2AC745CF93688B4EFDD3C3B6D5C2EA6CA91EF307036CDA2509FE8060362CCC52031447626CD195EFD85E198B827B14504CCE04AE9961
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............=J....mhL.............L................LLLD$.HLLLLLLRLEL.... ..{.....5lG..]jo.{[T....._.... ...B.+C.|..D^..H..R`.I[...BM....9.~.x.N31...pK...U.O..''z...w...XA...P...5X..nP..$.DdP<VdF.`d.V...&....h.y.b]7..P}...~..3..3...[c....1..s...[............j.....P.v...i.H.t......d.4.Q.V.KJ%......q....j+.3...b.i..[.....8...Sdy.....L81Dw5.9.%...9...5..!yk..H.IV...6.q.VW..G.3{&)E..{. ..v|K$.....E.gC@a...<t.....cy.4...~..r.$bH.Y...L...F..gN..O....6p..We..N...r{.9..;=.%..O..%]=..J.Y=#...//U.=>...F......G^........p.........c%.a.I#...G...8..8.or......!....o.S..6...L......1.c..CM.m...R.^.[:.@.0..6.j.v..A..#.&..+-..C...E.}./T...>...F......C..A...<^k.{Q,.2xaU...C%%U..m.....<....D....@.~.p......D...=JJ..q.G@...It...TI...?~.._._%5...L......ns.Y..k.....g..............XW7..CzZ9....ce@..M.....d...H9qB..J.%.......t...(.t.....5.i.2h).jK[.B3.\U.hW...aR.....sN.>..B.I:...n...3.U'.3.2.&......%-...dSM.,.Zx0..G7....myc....l...,.=.;d..f..l..|...!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60611
                                                                                                                                                                                                                          Entropy (8bit):5.42106306806935
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:9AiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAc:HM4A6UAHRHF4aId
                                                                                                                                                                                                                          MD5:B3AE1AC64334F6982F37BD162B8B7231
                                                                                                                                                                                                                          SHA1:90553EAD1FA8A610AAE01AAEE55D00CA1F8AC3FA
                                                                                                                                                                                                                          SHA-256:5C7FBBA35A536F9BEC9BD6FF7AAB7950C14F95D06FFE9F0DDF6557C337CC9CEF
                                                                                                                                                                                                                          SHA-512:4C407C1681D619167751AD81348D160C2A8024B565848C9C1FCC83A3C57C28D644EC3201AAA9636BC974C18289AEBB12DA637B86FE8E69350CB7B3BBDB9D5347
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...................I..................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\deepscan\ssr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):51501
                                                                                                                                                                                                                          Entropy (8bit):7.994537956176069
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:768:rL8a/Sdt5TzesF3i7/0Ika1g4N1U8iqcHYJg625AR6/UlHYKLQih210jJ:P8jzcx7/0Ikam+6n4Jg62GyMYKkihHd
                                                                                                                                                                                                                          MD5:D864A331B6509F6E99706C8359E82A37
                                                                                                                                                                                                                          SHA1:BDD41705ACD7CC9F35BFCA4695B0A200C66DE946
                                                                                                                                                                                                                          SHA-256:A983DA07A7BA4731DE6352F3C6AAD2B9BDB2881294787298F27ED1B3E02E455F
                                                                                                                                                                                                                          SHA-512:6FED75EAADFFE1CC7318610D64A2A0C5B76EF3357278F6F2D2E158DAE9236A38F7DD143092FAAC53B513DF44F09343E63001F1DB16552E03CABAC9675931586D
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<....................3W.j...............E...............=....s.c.....B..v.[t..=n......0.........L....#...6..;......w..y.....].R.A.W.Mow..3.`..H..^^^^.......:;..2.?...h..Iy....7....:|.+kp..z..:....c.Yy.....k....%.1<....................2.@.:4.\...[zU.@..:.c.w./.+.N*..?P...X:......6..r..vG/.k.:|...*..+p..J.;.(.....o}........z{..6*|...r.G.....+.c<1.OS..v.Z;.Rv..~...ZZ..>...v0r..o.f...l.~*..~....P..y.48.;......&.z....o.+.C.;....XA..6.@...C....b.+..z..........+..r..H...x..8......b...Q...[.6..K....&~.k.....9...<.{.C)...j..A.d.th.W.4.......r.>2..QUUTB..Q.+...7.tk.J.j...........}....RI.N.b..T8.k"6*62...1A..Fs.........p..L..5..j.P........3.H..=%.0c..>.....^*.<.C!..$.i..h;......~N..O...t.6...>..1..q............jR.....^.....{<.>Z..:.*.$.....B..J..H......u=.x^y.=.Y...A.B_..[.t..S.J..............M..^?.3.<.h."......2:......\.@...z...c$OGe.T......o.th......i.iM.q".AO...UO-XO'....W.]A#.]........'t..G.x...S<..7..!.&Caw7.p..-:E.,......#r.....*.O.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25664
                                                                                                                                                                                                                          Entropy (8bit):6.365558990975684
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:vjo5DtbqPXTWM8J5gj28EGl+2wM2A5Iarb9KvMljDGsQwRF:bo5Dtbq7WM8J5gi8EGl+2wMrIaf9plpz
                                                                                                                                                                                                                          MD5:4CE313A029AD128FB2F52B1A4E4BD418
                                                                                                                                                                                                                          SHA1:54269D242357E0D76AA21F2338CB7BC0C0089E55
                                                                                                                                                                                                                          SHA-256:6E84F998253D7BFFD47680B968C720F9BFE980E8093DACF50D32D42EBFF32F67
                                                                                                                                                                                                                          SHA-512:174777ADBB3C18AE187B651B348BCE166BDEA23A86C4795F5BBE0DDC953AC9B9204EA35AEE46EC096F2447E6F47565BF5EEFDC031E0389B9FAC87E1DA64566D8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........(...............................................P......(.....@.......................................... ..L$...........,...7...........................................................................................rdata..y...........................@..@.rsrc...L$... ...&..................@..@............. ._........]...........RSDS.....>.I.3IJ$.b.....C:\vmagent_new\bin\joblist\503376\out\Release\tr\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49784
                                                                                                                                                                                                                          Entropy (8bit):6.375735992254631
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:Gy2lF/WFLLpAEl6Zh7laV5tj01ltY+6JWYB+g3dv1Bgxby:v2kLlARh7LqJWYB+g3dv1Bgxu
                                                                                                                                                                                                                          MD5:F58CE9E8A9F3C3AB4B9F473C3147B0A7
                                                                                                                                                                                                                          SHA1:981F06BBB007F808CCFFC20559D7B4774672A2DE
                                                                                                                                                                                                                          SHA-256:F31EA236488F90B2592E8E3318179F1CEF0EE6BDAE7D235B93C1EF207DE7526C
                                                                                                                                                                                                                          SHA-512:7BD537600419AB09596534E7096F1144ED41865333B8B1DF5A7DE5991F715DF62019DE7D3E8CA11ED5EAE6CF2093AD72C79F00BB204D31B56BAF7BD35427F8AF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...].U...........!.....d...B......B...............................................Ec....@....................................(.......D........................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...D...........................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48248
                                                                                                                                                                                                                          Entropy (8bit):6.070509975205692
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:HXHGdBPASgYoH6dzSnq5TmtzG3TpMta2VPJ8lAobB+gDrtEw8Z9:CASgRcSqNmtzG39MkEOAGB+gDrtl8Z9
                                                                                                                                                                                                                          MD5:E501B44BC1EDC29BBA33CF834CA65FAF
                                                                                                                                                                                                                          SHA1:0F6E6591F947BFFF7A1FA558B1A73F016855BE4F
                                                                                                                                                                                                                          SHA-256:AA1CFD7F3CB5436AF5122A70F75106F1A4F6A039C38AAE17FC8B997530674228
                                                                                                                                                                                                                          SHA-512:C90CD2F84CCC1E57F682E8842165AE5D5FC526CEBD4AB263D75E18BD33F27E0DAE33688ED08F8B6F830BEAB08C360A0EDFA45A72369DDD157785E820024D7926
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...P.U.........." .....Z...F......................................................e.....@.................................................`...(.......L...........................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...L...........................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20960
                                                                                                                                                                                                                          Entropy (8bit):6.4400547662874885
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7dBSNAvsFSGKNz1uP51OfL4vY/6ki2cP0iwfL5un/a6cS+ShjmM6IGBkSBZ:H+AUFxKNz1wHML4x2cPfwY/yS+ST6nkY
                                                                                                                                                                                                                          MD5:0AF4EB8619C766434039AA98A8B2F0CC
                                                                                                                                                                                                                          SHA1:EF072B6888B915FDE9A6454C7DF1FB35DD830C01
                                                                                                                                                                                                                          SHA-256:173D0D53F297631776D4C46D7EBA3B4479C97EEDFCE5E07F470530C63C7A957C
                                                                                                                                                                                                                          SHA-512:41606E4E7F658664EB7C017E847D4302413F637CDF28D95A7688E7D53B6090D9C1F3FE0FFAFEA2341C66A5368A8B6F45FF55FF6ADEE819E048F9CA22E4E5F6DD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........$...............................................P......).....@.......................................... ... ...........(..H)...........................................................................................rdata..r...........................@..@.rsrc.... ... ..."..................@..@.............#pf........V...........RSDS..~....E...=.......C:\vmagent_new\bin\joblist\815456\out\Release\tr\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\appmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):31292
                                                                                                                                                                                                                          Entropy (8bit):7.98697494864025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:drQ8ffdzS2KN1gQxCFeWTuIoR7HBssluEqd8Knq:e24N6QckWT1O4q
                                                                                                                                                                                                                          MD5:DDDA5BE2E45D1C5229CD561A03825908
                                                                                                                                                                                                                          SHA1:D9207564DC229C9A05D9A7BAF8C7E2D17C62072B
                                                                                                                                                                                                                          SHA-256:C308EE41E48CC498C396A2CCBC57B7D29D058DD145F9867887544CB74112D63F
                                                                                                                                                                                                                          SHA-512:B16A67086A9D435CA17E35C7EFFDB639CF934A8671CF9F99F4E8F6846AD7E71BE71AED3BDE77A63F3189C155391EFE5287589CF6332DC8BE02E52C90C924EFB3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5.................................................................................................................a.p.p.m.o.n...d.a.t...............................................................................................................q.W.cNA6'!`;..#..[\.t.....7....{..s.....|B....H.r.%..]..b2r.K.P....7]4=....1.$9..~...(..V'Y.;...L....-...O...E.d.T.F..C).....#..w%..w.`...0....C..............0............C.F..*:...3G.!T...O.Dlo,'Q.....\S..3....c......ETN.<..#~..+>o...'L.Q.L..#.(....F.[.>.s-=?.=.u...H.b...L.\na=0'..h....Yy..H,...{..JJ...C..L......,.3..wO@K..&.Q\...5..cY&..2..).2.>.2`@VQ..UO.,d.i.F..@..;...b-<."..6:...g....i.<..0(GX...:...9.L<$."D..{.....`...=a.P..E.l... /..U<J~A.^F5sp.s.U-..Gf.R...=....'..%.>.ki..$\...N...>...A.Y...8.h.e...4...Zy._175.&.6..Ih.8.0L.=.cPD*.U...Uz..T..a'..k.po..;B....6.'.Z.'[=Z.,8.....3l[..^i.Q.-\S._{...Z..5.7....K+XD....Q.V..p......w-.9.(../.....0....,..Z...G0....ae...<.U.\.52x.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19424
                                                                                                                                                                                                                          Entropy (8bit):6.526781449385991
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:76C7tqB+9lN759u3jtg6ki2cP0iwfLFFJS+ShjmM6IGBkS9H9:Z7tqU1759u3jtT2cPfwpS+ST6nkk
                                                                                                                                                                                                                          MD5:486B6978797317CA25EB11405AB2E2BE
                                                                                                                                                                                                                          SHA1:882EF2C6A81B975DDC4A152CE753B0A4AEBA02BF
                                                                                                                                                                                                                          SHA-256:5BD02BB927C45A99A36AE2FBA786982F2B5C7AF0287046A64C90FE9EB2337552
                                                                                                                                                                                                                          SHA-512:C830BFFCF55FB886D0ED1030EBD3BC37FA9D68BE956813A1D2659B3BFEA5FBF3FDDC0C4C2F2F2FE177118BB4B50F0004A4920AA0A3C111CC0AF9E58CE785545D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@...........@.......................................... ..............."..H)...........................................................................................rdata..u...........................@..@.rsrc........ ......................@..@.............#pf........Y...........RSDS..B....K...t^<......C:\vmagent_new\bin\joblist\815457\out\Release\tr\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.968514351588424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:5vHP8qNfXOKM5VHblx1qhvmVqC7exscB3neUvESwTPprqWPQTUDnwENL1c:hHP8KX5M5VHRivmsCescReUsZPqid8
                                                                                                                                                                                                                          MD5:BD29091BA65B3FC08C79654997B4C82B
                                                                                                                                                                                                                          SHA1:3B353EC41DCC96D898715F6474656F13931C1B61
                                                                                                                                                                                                                          SHA-256:A3CFC3C8F95F0ED56306D28AC87408F10875C43BCA7778C6E1CC18C7A3441183
                                                                                                                                                                                                                          SHA-512:AE64DAE0E4025968BFB14E57C2FAAB0C9DA39943DAE9C884CBBD940433B29613C090B98899DB847C94B265F969A6ED3CFEBFF35AF284CA9619E6E25937067650
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................A..a,.@.-_...#.....2..vI...^..2..H"..........yU.;.i[..{.~:p.u.!...&..JnZ.......)px...@-T......7.HK.)...Z...[@n,4..h.C.!....#..w%..w.`...0..$................0...............q.%H...CK.d.d.=\I...).../..UQ.9z..@.(..gc3v.... ..v..+......`f.~.z........o+..}..az............(-z......3.*..7>T8O...._='..P.hX.....Itvz...r~$.....r.3....L.e..H|. z>x!;C..J..a.=..c$.....6..6..._s~..b"-...!.fI.&....w.]b......+....b...U./..m.6[.o.DS...=>..._C8.Av..yy.^*Sh-.s..Z......w\.n.;...q..h..Q.....<..V.........t.....4.6..F..=Q*..........0B..h.ja..=......|..>dz.,.)......&.......3..|..;]"q..A......R.y{.......$.d.L.:.......]j...G./<mFJ.!.,Lc.....Fcvw..{4.SH.*..m..l..|.?`N=d.l....O..y~....u9..?s....Jy..P

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32908
                                                                                                                                                                                                                          Entropy (8bit):7.98579519717503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:mqPy0zBxmlBLCxBIZuPVOWdT0bQUu9d2+8Pc1fCrGrP:m90nmlBLSBjt/T0MUu2ofCrY
                                                                                                                                                                                                                          MD5:F507C8DB8F8EC9361F36608408C9939E
                                                                                                                                                                                                                          SHA1:F3915EDB67FC281DDE5657B383E3A5AEDFE96BB8
                                                                                                                                                                                                                          SHA-256:DAB50E3C2787808BEEB0B377AD7C3DE2C518578B9F7A4EC4AC29063D59C00B3D
                                                                                                                                                                                                                          SHA-512:CB09E4F033B873211BFA8B8B82FA207EA5C176D8D686487C2253214F5F965734D2A16A04AE41B849FFA20B3B03814714274B749F07DBC28A0A5676A86630FEEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................r.e.g.m.o.n...d.a.t..............................................................................................................`1.!.../.C~.}.Q.i.{,..L......B.PG...xJ..L#.......B#.5J?.j}..f..`x.F.dG.p......."...VOn%.%M.D.;.F;.XL].o.S.DK....F[.....]....#..w%..w.`...0..d.6..............0..........X.6./).5.b..V..p,...u}".~..t...0...r..6,...c.....y..>.....lxh.t...O...-}~.c..1.'zv:..s..t^.|....%.."k.c....n.....J..x&. ._.-...\.9>.$.q.).~........v...b..IY.{...cp.f5..F.&..o.].V....0..J....w..f].%...!..\t.s+.J}....7.X..nI.z.M0...5...)x.8\G.._..w@.'..1....?=D.y.:Hw...9.@.Y.9.hd...$h^..I.G..gy..j.......5...nB.4 0!e..N...WQ.k....:x.9.`........3....38...W[..K1..{Q`..5P&z..8.J<.`.'+.i.y..0.a"Zu......KS......M..h...O..qbj..$../Z.M&...;...`..n.>..#.8. .m...|...s.$.K.T*c.....H.Z.S...P..5..#....^[.a=...........V.k..)r..%.i_.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):6.836310657250206
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7gdlAvvRDYJmOq1F7SD6ki2cP0iwfLgxUS+ShjmM6IGBkSV46:2lAXx7SO2cPfw0US+ST6nkJ6
                                                                                                                                                                                                                          MD5:2CE4C693A0E09B1F6B88AF294C0FACD6
                                                                                                                                                                                                                          SHA1:C788C679809CCDA3577E7C138349F21C41DF3BC6
                                                                                                                                                                                                                          SHA-256:AD7B98BD19B00DACA497F7F6A9D6DF039EAE6E4F7496A9F2295A11B4F07D1688
                                                                                                                                                                                                                          SHA-512:6ECD5DE87AB9D86610331F3DF8FB3A6281ECB34457613527611B308175EC2D87CD04F1DB0C5086E6D06F04FF5A03154213698C16270A6B97D8075C860060FD51
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L..._frf...........!.........................................................@.......t....@.......................................... ..................H)...........................................................................................rdata..t...........................@..@.rsrc........ ......................@..@............_frf........X...........RSDSWz....K../...9.....C:\vmagent_new\bin\joblist\815994\out\Release\tr\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1062, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1087488
                                                                                                                                                                                                                          Entropy (8bit):6.837164868247457
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:/MMCrgeLMLros23YOpr0y2AipmACB8B3p/4udhHA:WgBQs23xr0y27pmqQ
                                                                                                                                                                                                                          MD5:4F7CB0E939B745F0C12832A17CD15E07
                                                                                                                                                                                                                          SHA1:6D85603460E3B100FEA53C670BB1567633F6C554
                                                                                                                                                                                                                          SHA-256:C31F87D86DFC2B8BDEFA115090A4C8AD2916ABD60A720BB236500C19E57AF069
                                                                                                                                                                                                                          SHA-512:A3C7B4C6FD1A1432D3111446119EAEF633C4BF260CE82E1EAEC48C53409CF739BEC07BCC2FD81963722CAF4934423141D0494514EFF050F093D20840B1DA398F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......&.................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 217, database pages 790, cookie 0x8, schema 1, UTF-8, version-valid-for 217
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):808960
                                                                                                                                                                                                                          Entropy (8bit):5.828097878057771
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:l/nCExkRpiJhfKNJhhD5PpSpPd/m9muisxaAVpkf7:9CExkRgJhfKNJLh0PJm9muTaAA
                                                                                                                                                                                                                          MD5:8FD189512D8CCE198280374E7D9F60DA
                                                                                                                                                                                                                          SHA1:D7B20273F823032A6E13C6C46FE23C0399EFD19B
                                                                                                                                                                                                                          SHA-256:B25EDDA51E47A5753D480FCCB3A831FDA1C8FEF0E8EE58378A343090C47F371C
                                                                                                                                                                                                                          SHA-512:D892B155D13FF62D792F2EF9DBA43F18A044662CA66FA349ACB8FEF8B2B3EBCBF58AFDA330FE7EBE3ECA64DDBC418D1FC31B6F536B6487D11E1FFFF8366E086C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.........................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):31352
                                                                                                                                                                                                                          Entropy (8bit):5.948268625307151
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7PF7acsultAgwBAP3Excizfbr8fW3mQCM8z7eM+:pt4B23ESYfD3TV
                                                                                                                                                                                                                          MD5:905EC6F2E42B1B3455B8F9E5B221B35C
                                                                                                                                                                                                                          SHA1:BE6D385D11FE08B1442D7DBA9D2AE942466AACCC
                                                                                                                                                                                                                          SHA-256:03669A19803354C63829F7C3914C865F6533715DFBC2F09074D18418A4384BD2
                                                                                                                                                                                                                          SHA-512:1DCC19EF48B4A7D953198D93CEC0314FF2C3755A36598E69BD5F7D7413B40A53ACF6E6B1EBDAF7DBE0D4DF9A1BF49961208A12C0CFEDD0B71C1285703005050C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...!.LU...........!.........`............................................................@.......................................... ...]...........d...............................................................................................rdata..z...........................@..@.rsrc....]... ...^..................@..@............!.LU........^...........RSDS...... L.1.Zb..V....D:\360\svn\SafeInt_V6.2\i18n\I18N\SPTOOL\TR\Release\360SPTool.exe.pdb...............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2096
                                                                                                                                                                                                                          Entropy (8bit):3.760130941898797
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uNKlsBoT8FF527oT0LfTDuoT0ZTDjlb5YgM3lyDsDYoULXtI1:r3Nc6w8FC7w0L/uw0Z/jl9M3lEGYoAdo
                                                                                                                                                                                                                          MD5:25665B80DF4FA2BEB2AFF09F1279700A
                                                                                                                                                                                                                          SHA1:4BD781149215DB4F45229AA64155D028FE23C412
                                                                                                                                                                                                                          SHA-256:A1C782F62CA1B0AC12BAFB286E91B1EB975E3CB028F88B3A914F4E794596BF16
                                                                                                                                                                                                                          SHA-512:BB9C95240E0BE3FEC6C04FDA8DA9723C1D741F7CD2CC98D6778C616381A33CD44AE53C34892FF25C82E94E68F0B63C09BFDA87D8CFAC8AB3020DCF0363AF7721
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=.B.i.r. .p.r.o.g.r.a.m. .w.e.b. .k.a.m.e.r.a.n.1.z.a. .e.r.i._.i.y.o.r.....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=.^...p.h.e.l.i. .p.r.o.g... .w.e.b. .k.a.m.e.r.a.y.a. .e.r._.m.e.y.i. .d.e.n.i.y.o.r.....I.D.S._.T.I.T.L.E._.R.E.D.=.B.i.r. .T.r.u.v.a. .A.t.1. .w.e.b. .k.a.m.e.r.a.n.1.z.a. .e.r.i._.m.e.y.e. ...a.l.1._.1.y.o.r.....I.D.S._.N.O.T.E._.B.L.U.E.=.W.e.b. .k.a.m.e.r.a.n.1.z.a. .e.r.i._.i.m.i. .s.i.z. .b.a._.l.a.t.m.a.d.1.y.s.a.n.1.z. .b.u. .i._.l.e.m.i. .e.n.g.e.l.l.e.m.e.n.i.z. ...n.e.r.i.l.i.r.......I.D.S._.N.O.T.E._.O.R.A.N.G.E.=.W.e.b. .k.a.m.e.r.a.n.1.z.a. .e.r.i._.m.e.y.e. ...a.l.1._.a.n. ._...p.h.e.l.i. .b.i.r. .p.r.o.g.r.a.m. .t.e.s.p.i.t. .e.d.i.l.d.i. .v.e. .e.n.g.e.l.l.e.n.d.i.......I.D.S._.N.O.T.E._.R.E.D.=.W.e.b. .k.a.m.e.r.a.n.1.z.a. .e.r.i._.m.e.y.e. ...a.l.1._.a.n. .T.r.u.v.a. .A.t.1.,. .v.i.r...s. .v.e. .k...t... .a.m.a...l.1. .y.a.z.1.l.1.m.l.a.r. .t.e.s.p.i.t. .e.d.i.l.d.i. .v.e. .e.n.g.e.l.l.e.n.d.i.......I.D.S._.I.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):109056
                                                                                                                                                                                                                          Entropy (8bit):5.3453522666280335
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:GORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3U:GOBrUC4jyUJGKzgSg+oXOjk0FB
                                                                                                                                                                                                                          MD5:1BD56ABCBAB17558CEB4962BFC4AFB35
                                                                                                                                                                                                                          SHA1:B4E5AC479473A4E55219A17DFC142A55E611B0AE
                                                                                                                                                                                                                          SHA-256:87A111B320167FF8E2EA6093EC99CB5056503232AA50B80FF627D0C36DF5CED9
                                                                                                                                                                                                                          SHA-512:2DEC3DD0FAE65EF0F16DE7F32D051ACA81307E16DF3D6C61D00981E05338C4738397D5F45E34483A94983F010C7ECF4BA85A80FBB2734F6D2BAA94C83CEF6909
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........n......................................................,.....@.......................................... ..xk...........r..h7...........................................................................................rdata..............................@..@.rsrc...xk... ...l..................@..@..............2\........w...........RSDS.NQ...G.<.4........E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\tr\Release\360procmon.dll.pdb......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):53368
                                                                                                                                                                                                                          Entropy (8bit):5.899169795398446
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:bKJSpD9+1tFGHXt+2XrQHS4hI5R3dHIudC94:bKJS19+1k+2XruS4hI5R3dHIudCu
                                                                                                                                                                                                                          MD5:907E581A8A00BD2F6BCCF53F88358935
                                                                                                                                                                                                                          SHA1:0B27CE970EC216ECA6D034E1C018A86BE0065172
                                                                                                                                                                                                                          SHA-256:FA380A06AFB0080E1EDEC0B898B2CF50B6CFCAA0C270224CC7B1409FF55924EF
                                                                                                                                                                                                                          SHA-512:868A43B3C093DDE21D50DCF8E8267879ADE216CC9DE3DB56DB73E0A189865439034611FF78EC0B15AE91573C685E0BE5DA1117A7B41258A346242E261331907E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...{.U.........." .....Z...Z.......................................................Q....@.....................................................(...................................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):6.708719193495434
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7fpikHCmY7JI70HVJeMZHHlZqJO+QKvrfpMQ33C:AiCT7yQ1PHFZqo+QwtC
                                                                                                                                                                                                                          MD5:68061714C076FC56D8B61124F24BAC28
                                                                                                                                                                                                                          SHA1:52C018CA008D9CBC0AEE549B88B3B7AF2E3025EB
                                                                                                                                                                                                                          SHA-256:9815B511AEB8759E96626566DF9E7204F47702F7864D0B08A024B00EAE9869A2
                                                                                                                                                                                                                          SHA-512:D774F84395589C300248CA757C8DC93FB7857A5F60F45384AB109CE10AD65B6F88FF910AB9CDF5D6AE2B7BDB1DB0D058AE0FEE14FBEE9843CE79EC5A2C7148F4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........................................................0.......8....@.............................................@...............h7...........................................................................................rsrc...@...........................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...............................................................................................................................................................................................................................................(...8...................Z...........H................ ..D...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.112490863078052
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7eWB60bZMI7nOSeM/Ijb0A8nQJ+MQ3XLo:6WB60bZzLGb0AnJkLo
                                                                                                                                                                                                                          MD5:387C062E4397E322338153687BECFFDE
                                                                                                                                                                                                                          SHA1:AFB6D7244A813FF01B9F416027EEEAD036CCB247
                                                                                                                                                                                                                          SHA-256:116FA978A295CBE546BA330C0D06650C60961A5D4E68CD78E69A3830FD0DCDD6
                                                                                                                                                                                                                          SHA-512:C0205DCD4330F993122135635258B3E4F21E77ADF814E163CE4DDC75F2E83EAD45748C222A2ED8A97188F9E60413AB9891A29827907CC3DBC8CB078471F558C4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0............@.......................................... ...................7...........................................................................................rdata..}...........................@..@.rsrc........ ......................@..@...............[........a...........RSDS...:c.4I.D....6....C:\vmagent_new\bin\joblist\259671\out\Release\tr\UDiskScanEngine.dll.pdb............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19512
                                                                                                                                                                                                                          Entropy (8bit):6.955901495484703
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7Ca4GB2neR3K+h1MeK6jm7zDGPhCPQKvrfpMQ3R7X:2a4GB2e9K0MeKgmnDGoQwj
                                                                                                                                                                                                                          MD5:1C2510825964B2C836F193D4C7EA3D98
                                                                                                                                                                                                                          SHA1:F55E2D59A8EF7BED2C0DFA192D79FEF261D5D503
                                                                                                                                                                                                                          SHA-256:0BA6CB122FF80F4EBDF9C6133AC97611F95E922F12C0C3891B2C10BAE4471387
                                                                                                                                                                                                                          SHA-512:5A627BA8A55331F09BC077D150A28054E8605C24DFB0B1EC2DAD93D914CA49C1CCD3CEEFDB535C5DBB855D86A13789B880372F5C04AEB4D9AEC49EB5E37BC30F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... ............@..............................................................;...........................................................................................rsrc...............................@..@....................................................................8.......P.......x...................................................................................................`... .......................8.......................P.......................h.......................x...............................................................................................................................,...............8...........T...............p...............`...............................|...Z.............I.D.D._.D.L.G.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54392
                                                                                                                                                                                                                          Entropy (8bit):6.222107418533639
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:vGa7l/8h7DtJWRHS4hI5R3dHIuNYBA+zw:vgtJWxS4hI5R3dHIuNZIw
                                                                                                                                                                                                                          MD5:AC824B2AFADC09410489785D38BB3F2E
                                                                                                                                                                                                                          SHA1:CAF0BF97EA928E64952934D21BD605A008B8B999
                                                                                                                                                                                                                          SHA-256:82AB9389F83E67512334B04C02DA344C3769EEB1FEA65642D8327468FC193F59
                                                                                                                                                                                                                          SHA-512:D30C245C4593C7CF9159EB646E087CA8FC5390B32A378681568C20413DCC761AF375A24423849A60C4046F22566E915DE7023056ED7FA78F0E3FF572B5F609CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...:.U...........!.....d...T......B................................................k....@.....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc...............................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.778059494141471
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7tMBKCMQ0zyMrj1grjzR+vnr9ZCspE+TMArZ3dXeoH:7t5CZ02M8z7eMy3dF
                                                                                                                                                                                                                          MD5:2531D1B30E8DFC2760671731500AA429
                                                                                                                                                                                                                          SHA1:06A1231A3DE53FD3DB16CF72FC4D0FB3D024E7C9
                                                                                                                                                                                                                          SHA-256:838ADF933AB24E85EE72A27F68BACFAA447D0ED46EBD37DB95C76435012485AC
                                                                                                                                                                                                                          SHA-512:A777E1FFCBD7EAA352F878AC5A54B5A95DE992ED9462BC9449BCD970DF71347A367D6B3D8900CB412A2F73C05F99D80EA4E615921808382E3A635001633BFAA2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ............@..........................................................................................................................................................rsrc...............................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................8...........P...................`...........0...Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .t.a.r.a.y.1.c.1.s.1...M.i.c.r.o.s.o.f.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.6907213791968605
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7WMBKtMiJQvA8yMrj1grjzR+vnr9ZCspE+TMArc4h:7W5tbWvA/M8z7eMCh
                                                                                                                                                                                                                          MD5:AC5F431CBA9C1100C5B3A1FDCAA953A0
                                                                                                                                                                                                                          SHA1:082C2948E1B6D2F2136DE53035CD13383D29EAB4
                                                                                                                                                                                                                          SHA-256:DC223AB49538C69E2CA7EF6B67D274BF0AB84017A0C57469B774EBD06AEBB502
                                                                                                                                                                                                                          SHA-512:B378CCA0BF2212032F1C8E8004667B6B82A7D72372467DD1931BFF2896051D2442D3036BE6177D5DA59E6A958D22A3423FB34706D7D3DB91470842455F2B0928
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... ......c.....@..........................................................................................................................................................................rsrc...............................@..@....................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...................8...........P...................`...........0...Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n. .t.a.r.a.y.1.c.1.s.1...M.i.c.r.o.s.o.f.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):254
                                                                                                                                                                                                                          Entropy (8bit):3.747318374567946
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Q++uimVb8WSWlBADAoD0GPlpUsUVPiNAlK7kkcOQR4l8SWlBADANq:Q++ubxlLl2DND0GQ9V3lgOhR4GLl2DOq
                                                                                                                                                                                                                          MD5:D1B59E44F0CD63F732482DD2A5AB18CC
                                                                                                                                                                                                                          SHA1:44A732D457E8024DD675241B0910993F769379D4
                                                                                                                                                                                                                          SHA-256:8A0BE81019CBF91F12EB3CAE1536754937E55B62ADEF74D7608013AFB8D1D005
                                                                                                                                                                                                                          SHA-512:DB956EF0C3C7B5CA092B148309A2B54EF932D0B7280137DEFD075E960BB5A6B997720B9261B148CE41AE58DC042DBF1492959AC8244CE61771A503E6D96E4745
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=.T.e.m.i.z.l.e.n.d.i.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.^...p.h.e.l.i. .U. .d.i.s.k. .d.o.s.y.a.l.a.r.1.....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=.T.e.m.i.z.l.e.n.d.i.:.\.n.%.s.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8516
                                                                                                                                                                                                                          Entropy (8bit):3.5736590823884256
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVl2yYNNqWIajvWnwapG41iX8n8B6WSbJ1J9WNL6o52:29+DgRgizEG41s8n1WfFWT
                                                                                                                                                                                                                          MD5:986CB6D1C02B3917FC1F528EB794A216
                                                                                                                                                                                                                          SHA1:2DC98C634975AA716D895874383D07A05FB0F058
                                                                                                                                                                                                                          SHA-256:FFEE4D96AB913305AA1F03098DAC94B3BA85E25C5673555D04C1AC2CCF7CF023
                                                                                                                                                                                                                          SHA-512:EF2F0AC561FCFE7FCB0C05BD65BF5E5FC0F7185B765CEA5CC0054B2B1272749E269AC1E0BDD855DE4203332F2054E28A22AE44CE01AEB17A523D6FBC7149DBF4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.3366242719736654
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsNg6PCabR:r5u5/+mMks5qTp1mNqce9Oo26aabR
                                                                                                                                                                                                                          MD5:8CF340CAE39C8C92F61C31C34E22AA23
                                                                                                                                                                                                                          SHA1:F06AA290D5086D47AB7423D45CC6BDA7929751D2
                                                                                                                                                                                                                          SHA-256:E51D16A15A76A1C106E49BC10EFC2DB54B08D27152A3AB190BC1ED6BCBB24F76
                                                                                                                                                                                                                          SHA-512:ABE5C0023884B0CFAC2739E81CD9127B8321F68655638D39DA34E0E4ECE2B5530AFCECA436D626AF7F2D60448C4F603FCB031B8067FE7C4ECD196FB159B2D56C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\tr\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10568
                                                                                                                                                                                                                          Entropy (8bit):6.811594221456347
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7jp0kvNyMrj6Pu7CrjzR+vnr9ZCspE+TMorCxu:7jpJMMCPHz7eMtu
                                                                                                                                                                                                                          MD5:5EFD82B0E517230C5FCBBB4F02936ED0
                                                                                                                                                                                                                          SHA1:9F3EA7C0778FEDF87A6ED5345E6F45FB1BD173FB
                                                                                                                                                                                                                          SHA-256:09D58A2F0656A777A66288AC4068AA94A2D58D0534328862B8371709EAB2003B
                                                                                                                                                                                                                          SHA-512:12775C718F24DAA20EC8E4F3BDEDE4199C478900B12ADDCB068AE7B20806850FDC903E01C82E6B54E94363725DCFF343AEAC39C3512F5EA58D1BA8D46712AD33
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......S...........!......................................................... .......0....@.............................................d............................................................................................................rsrc...d...........................@..@....................................................................(.......P.......h.......................................................................................................................................................................................(.......................8...H...8...............................................x...............Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.f.o.x.,.I.n.t.e.r.c.e.p.t.e.d. .%.s. .v.i.s.i.t.i.n.g. .%.s. .[.H.a.r.m.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):131136
                                                                                                                                                                                                                          Entropy (8bit):5.540436595266123
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:jimVVOWFbLpAEl6kh7lqFVT01/woMRoUrUK5/bGnO7Ecm7DcsaIGZwdWWfFKIfRa:+mvblAch7p+RoUnqzagfBPOMop0K
                                                                                                                                                                                                                          MD5:033E5148EB4D4506008A3C2366346100
                                                                                                                                                                                                                          SHA1:E0AA9E25EA4B75C9015B157423D37B7D04CA5BDD
                                                                                                                                                                                                                          SHA-256:E147270852044965DB5D45413A5B6806E6D20997D354AF97E9F8D4929F37BD2E
                                                                                                                                                                                                                          SHA-512:C416C5C4178DF87C70F6220606CAD4D5EB3FA5A168E91D28A6B0FB5E023E0BC0F9972245AFFAA33E90AD5E5959DC0F5C781E95B40B03FBCE1486F0655E3FF35A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L...i..[...........!.....d...^......B.....................................................@....................................(........$...............7.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc....$.......&..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1748
                                                                                                                                                                                                                          Entropy (8bit):4.010272841960805
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:r+uLgQVn9sdkRQJ8aR/9s4+0JY7Z18Lqo+eFoaJLZa:r3LgQV6d6QKaJ9s4jJY7z8LqDIoCLZa
                                                                                                                                                                                                                          MD5:61AD685FAFA83328CC0F30981989FB17
                                                                                                                                                                                                                          SHA1:956EA5D113508D767C57F7C783D0F6F7F5F2C3B6
                                                                                                                                                                                                                          SHA-256:44709E9665845062F7AED45D8480BAB980FC685A622F4102D0CCDA4B35107E6D
                                                                                                                                                                                                                          SHA-512:5D9F028553A320B4659178084A813FF37015AA9373B0B945BCDF755A8D323E9D6016A54387C59E37E6C0D70E5DA232CFE055EA3F1B83DC16C39196B599EEEF81
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.B...o. .c...o. .l...i. .3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y.....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=..... .g...p. .p.h...i. .s... .c... .n.g.h.i...m. .t.r...n.g.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=.C.h...n.g. .t...i. .r...t. .t.i...c. .n...u. .v.i...c. .n...y. .g...y. .p.h.i...n. .t.o...i. .c.h.o. .b...n.......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=.C.h.....n.g. .t.r...n.h. .b...n. ...a.n.g. .s... .d...n.g. ..... .g...p. .s... .c... .v... .p.h...i. .....n.g... .H.y. .v...n.g. .b...n. .c... .t.h... .g...i. .n.h...n.g. .t.h...n.g. .t.i.n. .n...y. .....n. .t.r.a.n.g. .w.e.b. .c...a. .c.h...n.g. .t...i. ..... .g.i...p. .c.h...n.g. .t...i. .c...i. .t.h.i...n. .c.h...t. .l.....n.g. .s...n. .p.h...m... .C.h...n.g. .t...i. .c.h... .g...i. .t.h...n.g. .t.i.n. .b...n. .t.r.o.n.g. .b... .n.h... .v... .k.h...n.g. .b.a.o. .g...m. .b...t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\LibSDI.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):104020
                                                                                                                                                                                                                          Entropy (8bit):7.998250300730501
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:sNHng0MenTD5aDlAeHoKCiZMIziG/+j2EOvOBh:EHg0LnTDgBHoKxmBh
                                                                                                                                                                                                                          MD5:68F593F5476A358379EA9AD528FBC479
                                                                                                                                                                                                                          SHA1:526B9DAF9E25EA88412B327C4BABE10DD6C4D221
                                                                                                                                                                                                                          SHA-256:7F78C86E9B84E20D05D9A00F035B2B9AD95DD78A9A7307198E6D8C901408A9D9
                                                                                                                                                                                                                          SHA-512:4C11CACFCC89543E2F05CA9541DC1B25C35C2FE35208DB12EB5FD64C978C052513938561B45459F3D994EED230D9243D0E5CF1DCF2E1FBC890FAA562E8D2A04C
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:B..d=..n...l.6.......r.Q... ..O."..j.@.=-.l....S....d<.r......"..O......O...1!..=....c.F.+B].`.'|........<K..'.%u...=....x.,.x........#..!.9.Y8lT.E.....9....0...3.l9..k.^.9....:'cB?v+.FI&A...J..c..vD...&."B..9(+Q.I.....c...o......!$&.p..@. ........|a5.'....t....!Rs._.U.*...uB?@X.y<$L.o..ry..q.t..F..D...]oU...?v...v.J`..it.Q.i.~w7......e..4.T..+......+....".....u....7.Y..O...YO.g.4)..(.h......!E~...M=9.td..n.f...d.EFq=..US.t$....G.B$3e..L1....!.G..=T<#.#...Z.!....d.J..e..dq(P;nS...[..N...J?R.9q..Bx] n'eC.n..... ......w.E.......M.m........5...KaFc4...$.Q.....u.......fcz(!...tl.....X.(..X.$..m.g..m.U&C.R..S..j~....-`....O}.Y..{...X.)...G..?.........>a..f(..c.... .D.9N....~ U.z..F.......X.;3+...:Z~..._...}....$.:J^...J:.\.-....!lBd..*.(..y...V..e.%$.(..A...:A.G+eT...]!>..t.v-.RM..:.&.......c..x...p..$..B.F..j.$.`.......A....r..P[.#..[.9R....:...`l..i.^.....;JMQ..g,.qZ..m^..R...w....I>.L..4.3ab3h`...Op.........e.z..B..U.Q,{.x$.JH..y.....B..t|.,.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.606888008196333
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7dntGHtDGkvI7nOSeMISjnAuaA8nQJ+MQ3sn6E:hntmDGkApnAuaAnJXnz
                                                                                                                                                                                                                          MD5:06160E8A333B40B82AB3AC37242DB65C
                                                                                                                                                                                                                          SHA1:F32EECC1B205B681B599EE9E48B97BCA0E8A51AB
                                                                                                                                                                                                                          SHA-256:557DA8B8FEE2656D80A5AA9E20F5F3DD4809ED2C93EE6D83A9FB6F954D29EE07
                                                                                                                                                                                                                          SHA-512:EFDC2B5F035F5E06A7641F913DFD9F325D837E4A2FE5D46C913E565FA150C38CFA864900BAC9171F442A3B95D07F9D528E15637723A7342CA958CE5C93700117
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...U;.[...........!.........................................................@.......i....@.......................................... ..`............ ...7...........................................................................................rdata..y...........................@..@.rsrc...`.... ......................@..@............U;.[........]...........RSDS..3...M.7f.dN......C:\vmagent_new\bin\joblist\258920\out\Release\vi\UrlSettings.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111160
                                                                                                                                                                                                                          Entropy (8bit):5.729015074427482
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:Py2lF/WFLLpAEl6Zh7laV5tE01Zt1oMRobq12dSSswdUdo5jP8QsBv9K0MeKgsD5:q2kLlARh7ArRobrdSSswF8QsBv9we
                                                                                                                                                                                                                          MD5:A0378008530F488CC69062EC540C9AF1
                                                                                                                                                                                                                          SHA1:A3B9D86E695E62250199816EE519627045F3D9F1
                                                                                                                                                                                                                          SHA-256:1AD96C64FEFE863EC03A034606E87FCBF8F231BFFF38A496C7295679C5DA999A
                                                                                                                                                                                                                          SHA-512:55BBB20922BEDDD748EB770C48547EB43FB5E111B7536EC80CCAA8303B5B008740CF9AE2EB98B7C5CC1F513460D9694BB5540F8C291ED6913D9CEE28546195CF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B................................................$....@....................................(....................v...;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...............................@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):104024
                                                                                                                                                                                                                          Entropy (8bit):5.558497548416664
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:bSWFluWFrLpAEl60h7l61HE01dPoMRoyLbhAk2dlbsUdUdemcnEwB1ZkdmU:2WPrlAMh74pdFRoy8dlbsClEwB1Zk0U
                                                                                                                                                                                                                          MD5:B1EF5E448DF0E546DC29DB3A5E93EECE
                                                                                                                                                                                                                          SHA1:140DF1E1F8251EC402DED93ACE6F2AEB0260B602
                                                                                                                                                                                                                          SHA-256:419C2ED5E04D78A3EF91DBE91A973E40AC175181552A5913B4DED3235429333F
                                                                                                                                                                                                                          SHA-512:D0C4EC7A55C9E86C405BBA0E65DB37E445C4C2888B671D7702AA0CEEB246DBBD375E457C2DCD30CB8B037C6D0305CDD65ABE9E23F184328951A3FD6F82D7431B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L.....-V...........!.....d..........B................................................A....@....................................(....................v.............. ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc...............................@..@.reloc...............f..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):90680
                                                                                                                                                                                                                          Entropy (8bit):5.993460314703085
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:7PVmvblAch77CRoYdSSsgfxBPoYh9we9:58CRoYdSSsgfoYh9
                                                                                                                                                                                                                          MD5:083639D44467A7372E47B67B09EEE6AE
                                                                                                                                                                                                                          SHA1:4BA68CD67366371EC2B1A9B2FF82F14A92FF66B2
                                                                                                                                                                                                                          SHA-256:1A82123D0BC413D79732F4ED915D0AB943E33B4D012FBDB91CC451A6BA71DCE2
                                                                                                                                                                                                                          SHA-512:584F65711AC4875E477A722B2212D45668F2B4AB0C96F1805DDA2ADABEC71C0C6660F7A8A0FE9E470BDC058FEC1B65E9043449DB3CFFA7CB47269EB6450B13EC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................`............@....................................(...................&...;...P...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc..............................@..@.reloc..|....P......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\dsconz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19078
                                                                                                                                                                                                                          Entropy (8bit):7.990811205317892
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:384:vAG4SpbwEKYAbje8a66SbGYQoYtIglDTuREcPJhs5p6I6Vukh6lXNTQ:XbSj0SbDQoYZlDT9cPJQ6I6o4mNc
                                                                                                                                                                                                                          MD5:015D57EA3EE95B22893B44D8D905BC07
                                                                                                                                                                                                                          SHA1:436A16DC438ADD3AA096099B4D404E26A5724AD9
                                                                                                                                                                                                                          SHA-256:EFD7B0E32E125209906F275F1D8F60DF36427557E2AFA2A863199941CFF99394
                                                                                                                                                                                                                          SHA-512:11737FEEBFFFD571AF0B52450088C732C1D9067102C181BA62E783E92CDC239A023AB6C7B571EC7614F706BCA2AD3B06FD81BEFB70ED69B87EAF8C953619C1C4
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............JJ..P.&pK..(...........L................LLLD<.HLLLLLLRLEL.... ..{.....5lG..]jo.{[T....._.... ...B.+C.|..D^..H..R`.I[...BM....9.~.x.N31...pK...U.O..''z...w...XA...P...5X..nP..$.DdP<VdF.`d.V...&....h.y.b]7..P}...~..3..3...[c....1..s...[............j.....P.v...i.H.t......d.4.Q.V.KJ%......q....j+.3...b.i..[.....8...Sdy.....L81Dw5.9.%...9...5..!yk..H.IV...6.q.VW..G.3{&)E..{. ..v|K$.....E.gC@a...<t.....cy.4...~..r.$bH.Y...L...F..gN..O....6p..We..N...r{.9..;=.%..O..%]=..J.Y=#...//U.=>...F......G^........p.........c%.a.I#...G...8..8.or......!....o.S..6...L......1.c..CM.m...R.^.[:.@.0..6.j.v..A..#.&..+-..C...E.}./T...>...F......C..A...<^k.{Q,.2xaU...C%%U..m.....<....D....@.~.p......D...=JJ..q.G@...It...TI...?~.._._%5...L......ns.Y..k.....g..............XW7..CzZ9....ce@..M.....d...H9qB..J.%.......t...(.t.....5.i.2h).jK[.B3.\U.hW...aR.....sN.>..B.I:...n...3.U'.3.2.&......%-...dSM.,.Zx0..G7....myc....l...,.=.;d..f..l..|...!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60906
                                                                                                                                                                                                                          Entropy (8bit):5.4769273627529795
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:nAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAU:RM4A6UAHRHF4aI/
                                                                                                                                                                                                                          MD5:C6013CF18162159CD775728CA1AE477F
                                                                                                                                                                                                                          SHA1:4917F160184F683237DD33EE839D68ADEB28AD41
                                                                                                                                                                                                                          SHA-256:8C455F8412AAA8CEE69BDC70DBC2CCFD60AAAF4CDACD407BE69BEEE08BDD0B50
                                                                                                                                                                                                                          SHA-512:5B892C3D6946C52336B7D37632959DC275655E74AC080F3493F8F4F1921B67E86F9D021BADA820D429E76D28DF6FE40B26C78E760F7779A38B2290C22C37DA43
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...................5R..................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\deepscan\ssr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):52118
                                                                                                                                                                                                                          Entropy (8bit):7.993099731584321
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1536:rI/pCpj90YfGgFT3vSc+cCOOrPK95bqpC26Zfzu8zSufV:sp4j9FfZJSc9KzKipzyutu9
                                                                                                                                                                                                                          MD5:AE5ACF7680E09DCEEB056A86217EEDAF
                                                                                                                                                                                                                          SHA1:8404DCCE1C58EC390E6ABBD8255EB913E49EAFC8
                                                                                                                                                                                                                          SHA-256:2BC8C1C9A907E4105B967655378BBB79B8D427441A6A32B1476D84CBD2AFDBF0
                                                                                                                                                                                                                          SHA-512:138AD9530B9D8B7BC389D7EDCDDD5F33EB88E2392FD692B5B403B1A4784E46095BFE03E6A6A9DFB297102CD5A0EF9510C7B3A8A97DF486F0128651CF98D92974
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............Z.....n.CH..q./0........E...............=....a..c.>S.2...H4s..3.........0 .Q2'....I...4...Z.;MH$..I_H.tU.Ad.....h_.@.z..b...v6.M2v626Jr.!l.)w.#..4..Y~3......:..j..6:.Y.".|G2...z^.....2....>.....:....9P.[y/..Z...RR.......;....f.L.bz.L.....r...K...m.jKz..pu.R..J5.....J.%p}......98.].MeV...&.z.b.|g.#.......;3......&?............_f:|......*#."r..O.vy.r.j.jr.*...qqc..rV.y.27{.<.7.......r..<3.{...+.......5.....n.\@..Q..z.eu....n.=g..a....G]..{.<..&...;...Q..\........q.....#...Z..:Zp5.C........1u*...Z......4.......n...!7.T.RR]V..K^...K..:.%.:PO(3...#.Y.F..5#...TTk..z^H.)o.v.L.r-8.....t...6.p._.....1.........)q...R{8.......h....Bz..b.)...KS..Z...9.;..K........V..e....1p....%...!zZ.b..w.oYo....J;.A.t.\.Q.:.*.)1.8.......<..B.$Q..Xg...PT.`......+.....B..J..F).t.8..<..27...q.M.LI..\..V.P.J.Z...6:w.j.....K<S";.:.........<1.9.......j....Zg.R....aAE..EF........v...&J9....A.M..T..gQ....e[...p.L.%[.Py_...:.3..)..Vwf.k.:.3..}".

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25664
                                                                                                                                                                                                                          Entropy (8bit):6.481826557365926
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7w5xkJh9aI76eR3KJ1MsZ+sfDGPhCFYov05MQ3n:M5xk7b9KvMs+IDGZoG
                                                                                                                                                                                                                          MD5:51E15B3538505C319F6DBAE2574BA1C1
                                                                                                                                                                                                                          SHA1:64F83D17DA25FF8C5EB80714FAB40928AFD79374
                                                                                                                                                                                                                          SHA-256:26BF7C04A22A87E171BBF9009239CB9CF629384DA5D93C876BF222D70930AF98
                                                                                                                                                                                                                          SHA-512:006B89F1E5639737CBB616DC77E4FDA24AE39689A060F2D954E6C2B269B27D713442A4693F56B7DCE8B3F631DE4D80AE1947566ACFBA3738D176C49D271F857A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........(...............................................P............@.......................................... ..$$...........,...7...........................................................................................rdata..y...........................@..@.rsrc...$$... ...&..................@..@............. ._........]...........RSDS.v.6B.A..P.C......C:\vmagent_new\bin\joblist\503376\out\Release\vi\NetDefender.dll.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49272
                                                                                                                                                                                                                          Entropy (8bit):6.365768671892917
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:oy2lF/WFLLpAEl6Zh7laV5tp01TtY+6JWLdvMBpfw2:l2kLlARh7ZIJWLdvMBpfb
                                                                                                                                                                                                                          MD5:3F4860D2E9C20406154D09C73AE31B6D
                                                                                                                                                                                                                          SHA1:66D13F17DCD6B1EF39AA1C131AA5B747A06145CE
                                                                                                                                                                                                                          SHA-256:6D984A7B1F7CBFBDF17998F81829B723BFE7D38D3874A05F9BC3991C8AC3FB55
                                                                                                                                                                                                                          SHA-512:F3FFEAE91C2743E1F3FCB8D20592B9D1421689107834700A7E9880D58025322D68EAB196F00AE61C113D906FE9E9444F55CD4B265B41DA6BF840EEB7ABD4B906
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...[.U...........!.....d...@......B...............................................Y.....@....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):47736
                                                                                                                                                                                                                          Entropy (8bit):6.060260128506416
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:LXHGdBPASgYoH6dzSnq5TmtzG3TpMtaNVQJ8lAo1rtJJ6wqw:WASgRcSqNmtzG39Mkf3AArt7Nqw
                                                                                                                                                                                                                          MD5:F6D9E350A3363ECC1306656BD82BD97E
                                                                                                                                                                                                                          SHA1:CB8CADBE0487D48637EB1FFC61E15FE9BB748D3F
                                                                                                                                                                                                                          SHA-256:0920EFF1AC8BE66305847FDBF0747A2158AE061C9F67DDF5D15B9B73F2A8A40F
                                                                                                                                                                                                                          SHA-512:4B1F4B6B4BC8A066238CC42BACF1D1EF02181814C36147E061B00D7F8C48A8AC3C0A112EF7A09506A261C6AF3786530F0A31F51D9BC6B8B989802442C52CE34F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...Q.U.........." .....Z...D......................................................+u....@.................................................`...(...................................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20960
                                                                                                                                                                                                                          Entropy (8bit):6.527460777599175
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7L01Ml5Z5xl4m6ki2cP0iwfLiaR7UM4S+ShjmM6IGBkS5b:3Vl5Z5xl62cPfwHaM4S+ST6nkOb
                                                                                                                                                                                                                          MD5:558004A39890EFF3E0BBA299952AC7A5
                                                                                                                                                                                                                          SHA1:70E2C4800CFFE50924ED1D061CD50CC35C65A8AE
                                                                                                                                                                                                                          SHA-256:B6BE646A262ADEFD8DF8D18AC32D190EE6FB22963D6F1FC4E8BB737DAD74A3CE
                                                                                                                                                                                                                          SHA-512:DF5AD97B6DA3DD103A3DC3F4528CBD864E59561AB830EB0BEB3577DF4B54143ACEF137CFCFF33FDB72931C2EB4BD419D745ADC6E4342A0AB9161247A8EAD052C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........$...............................................P............@.......................................... ..4 ...........(..H)...........................................................................................rdata..r...........................@..@.rsrc...4 ... ..."..................@..@.............#pf........V...........RSDSs.4...W@...&...:....C:\vmagent_new\bin\joblist\815456\out\Release\vi\appd.dll.pdb.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\appmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):31292
                                                                                                                                                                                                                          Entropy (8bit):7.98697494864025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:drQ8ffdzS2KN1gQxCFeWTuIoR7HBssluEqd8Knq:e24N6QckWT1O4q
                                                                                                                                                                                                                          MD5:DDDA5BE2E45D1C5229CD561A03825908
                                                                                                                                                                                                                          SHA1:D9207564DC229C9A05D9A7BAF8C7E2D17C62072B
                                                                                                                                                                                                                          SHA-256:C308EE41E48CC498C396A2CCBC57B7D29D058DD145F9867887544CB74112D63F
                                                                                                                                                                                                                          SHA-512:B16A67086A9D435CA17E35C7EFFDB639CF934A8671CF9F99F4E8F6846AD7E71BE71AED3BDE77A63F3189C155391EFE5287589CF6332DC8BE02E52C90C924EFB3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5.................................................................................................................a.p.p.m.o.n...d.a.t...............................................................................................................q.W.cNA6'!`;..#..[\.t.....7....{..s.....|B....H.r.%..]..b2r.K.P....7]4=....1.$9..~...(..V'Y.;...L....-...O...E.d.T.F..C).....#..w%..w.`...0....C..............0............C.F..*:...3G.!T...O.Dlo,'Q.....\S..3....c......ETN.<..#~..+>o...'L.Q.L..#.(....F.[.>.s-=?.=.u...H.b...L.\na=0'..h....Yy..H,...{..JJ...C..L......,.3..wO@K..&.Q\...5..cY&..2..).2.>.2`@VQ..UO.,d.i.F..@..;...b-<."..6:...g....i.<..0(GX...:...9.L<$."D..{.....`...=a.P..E.l... /..U<J~A.^F5sp.s.U-..Gf.R...=....'..%.>.ki..$\...N...>...A.Y...8.h.e...4...Zy._175.&.6..Ih.8.0L.=.cPD*.U...Uz..T..a'..k.po..;B....6.'.Z.'[=Z.,8.....3l[..^i.Q.-\S._{...Z..5.7....K+XD....Q.V..p......w-.9.(../.....0....,..Z...G0....ae...<.U.\.52x.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19424
                                                                                                                                                                                                                          Entropy (8bit):6.639088551707327
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7G+9lTlCRjAB6ki2cP0iwfL2/OnS+ShjmM6IGBkSv:1rlGjA02cPfwKCS+ST6nks
                                                                                                                                                                                                                          MD5:E996A87EA9BA0F63B6E6BE311B72C038
                                                                                                                                                                                                                          SHA1:22F2E4726DA527E716EA1FD857AB49803B826D34
                                                                                                                                                                                                                          SHA-256:4E4DF8C4AC75CAA6AEBB4B7DAE686A0A4BB35B82BA093AF05F9225E114304D6C
                                                                                                                                                                                                                          SHA-512:CC25944D392BBBE8EC0F31059EC604D46039F7ADFDA3A678058C49AEE48C7B17569F42499723B19A156EEC7CC0BAAF5756AE20DF48C4FC9B6CE7F71F66A2EFCF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@............@.......................................... ..............."..H)...........................................................................................rdata..u...........................@..@.rsrc........ ......................@..@.............#pf........Y...........RSDSa(<...:J..i1d.m/....C:\vmagent_new\bin\joblist\815457\out\Release\vi\filemgr.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.968514351588424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:5vHP8qNfXOKM5VHblx1qhvmVqC7exscB3neUvESwTPprqWPQTUDnwENL1c:hHP8KX5M5VHRivmsCescReUsZPqid8
                                                                                                                                                                                                                          MD5:BD29091BA65B3FC08C79654997B4C82B
                                                                                                                                                                                                                          SHA1:3B353EC41DCC96D898715F6474656F13931C1B61
                                                                                                                                                                                                                          SHA-256:A3CFC3C8F95F0ED56306D28AC87408F10875C43BCA7778C6E1CC18C7A3441183
                                                                                                                                                                                                                          SHA-512:AE64DAE0E4025968BFB14E57C2FAAB0C9DA39943DAE9C884CBBD940433B29613C090B98899DB847C94B265F969A6ED3CFEBFF35AF284CA9619E6E25937067650
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................A..a,.@.-_...#.....2..vI...^..2..H"..........yU.;.i[..{.~:p.u.!...&..JnZ.......)px...@-T......7.HK.)...Z...[@n,4..h.C.!....#..w%..w.`...0..$................0...............q.%H...CK.d.d.=\I...).../..UQ.9z..@.(..gc3v.... ..v..+......`f.~.z........o+..}..az............(-z......3.*..7>T8O...._='..P.hX.....Itvz...r~$.....r.3....L.e..H|. z>x!;C..J..a.=..c$.....6..6..._s~..b"-...!.fI.&....w.]b......+....b...U./..m.6[.o.DS...=>..._C8.Av..yy.^*Sh-.s..Z......w\.n.;...q..h..Q.....<..V.........t.....4.6..F..=Q*..........0B..h.ja..=......|..>dz.,.)......&.......3..|..;]"q..A......R.y{.......$.d.L.:.......]j...G./<mFJ.!.,Lc.....Fcvw..{4.SH.*..m..l..|.?`N=d.l....O..y~....u9..?s....Jy..P

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32908
                                                                                                                                                                                                                          Entropy (8bit):7.98579519717503
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:mqPy0zBxmlBLCxBIZuPVOWdT0bQUu9d2+8Pc1fCrGrP:m90nmlBLSBjt/T0MUu2ofCrY
                                                                                                                                                                                                                          MD5:F507C8DB8F8EC9361F36608408C9939E
                                                                                                                                                                                                                          SHA1:F3915EDB67FC281DDE5657B383E3A5AEDFE96BB8
                                                                                                                                                                                                                          SHA-256:DAB50E3C2787808BEEB0B377AD7C3DE2C518578B9F7A4EC4AC29063D59C00B3D
                                                                                                                                                                                                                          SHA-512:CB09E4F033B873211BFA8B8B82FA207EA5C176D8D686487C2253214F5F965734D2A16A04AE41B849FFA20B3B03814714274B749F07DBC28A0A5676A86630FEEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5...............................................}.................................................................r.e.g.m.o.n...d.a.t..............................................................................................................`1.!.../.C~.}.Q.i.{,..L......B.PG...xJ..L#.......B#.5J?.j}..f..`x.F.dG.p......."...VOn%.%M.D.;.F;.XL].o.S.DK....F[.....]....#..w%..w.`...0..d.6..............0..........X.6./).5.b..V..p,...u}".~..t...0...r..6,...c.....y..>.....lxh.t...O...-}~.c..1.'zv:..s..t^.|....%.."k.c....n.....J..x&. ._.-...\.9>.$.q.).~........v...b..IY.{...cp.f5..F.&..o.].V....0..J....w..f].%...!..\t.s+.J}....7.X..nI.z.M0...5...)x.8\G.._..w@.'..1....?=D.y.:Hw...9.@.Y.9.hd...$h^..I.G..gy..j.......5...nB.4 0!e..N...WQ.k....:x.9.`........3....38...W[..K1..{Q`..5P&z..8.J<.`.'+.i.y..0.a"Zu......KS......M..h...O..qbj..$../Z.M&...;...`..n.>..#.8. .m...|...s.$.K.T*c.....H.Z.S...P..5..#....^[.a=...........V.k..)r..%.i_.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):6.910463067373762
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7GC4lZgWGBkXU6ki2cP0iwfLQhtNS+ShjmM6IGBkSDq:0lZg5BkP2cPfwCtNS+ST6nkt
                                                                                                                                                                                                                          MD5:996AA04FBC5D48649DD121F780A86A36
                                                                                                                                                                                                                          SHA1:F9FA72DDFE61BB88A3991BEC00799704E7005B5A
                                                                                                                                                                                                                          SHA-256:0DFFE95A27217FC53DEE5C3D998D85008A9E9DDE2A2B2741390CBF459FA0A7BB
                                                                                                                                                                                                                          SHA-512:073D78408CB1FAF97417760580943868E8B6E493F54280E4D7A0E88B68568F1259E00FFA6868F4E33CE9606BCD787F5A4AA0495C9AF2E3DBCF5C6E0298994FB7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L..._frf...........!.........................................................@............@.......................................... ..<...............H)...........................................................................................rdata..t...........................@..@.rsrc...<.... ......................@..@............_frf........X...........RSDS..1GR^.C..."vJ%.....C:\vmagent_new\bin\joblist\815994\out\Release\vi\yhregd.dll.pdb.....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1059, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1084416
                                                                                                                                                                                                                          Entropy (8bit):6.833805968896969
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:gMMc16WcDBYoY23FMaTBC+mdaIhQaB8B3pjnpth2C:36dbY23xTBC+ahhqN
                                                                                                                                                                                                                          MD5:8F236D6B47AC06565E1696503752A6C6
                                                                                                                                                                                                                          SHA1:B178576154F67F590861557FFA55530F429E67F6
                                                                                                                                                                                                                          SHA-256:F1A6FF673475D5772BBAA4A7AAC1C904238E41482AF71A526A1892023FF69D7A
                                                                                                                                                                                                                          SHA-512:9EFE31BD88DE2D33A270AE54637BEF9A52D36B3E69BD2FBC5D5793FBA58F57CF018EF882A087CA77589A73BF7CE7A966BDA8F7233121805984832958FAA2A143
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......#.................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 217, database pages 791, cookie 0x8, schema 1, UTF-8, version-valid-for 217
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):809984
                                                                                                                                                                                                                          Entropy (8bit):5.828390216811411
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:1/nCExkRpiJhfKNJhhVdTTOfPd/m9muisxac+ck9l:tCExkRgJhfKNJLHMPJm9muTacc
                                                                                                                                                                                                                          MD5:92440B3E7A15CB6E316747F15A8D1879
                                                                                                                                                                                                                          SHA1:68E3F062259B47DD39CB50F401F01AE858DC2D84
                                                                                                                                                                                                                          SHA-256:7C2334503834CAC94882D9B9842186A36D2132CE22F349396B8E2AE3C4DE5EBA
                                                                                                                                                                                                                          SHA-512:8DE64E7CCD58321CD7F79B2089623CD4570A99AB76FC2BDDA0880B1CE49E16ABD6D68C2E9C7E778DBA31923E95BD9CF41957A690E11E0ED404C791C80DCD88EE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.........................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):30840
                                                                                                                                                                                                                          Entropy (8bit):6.041847633616699
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:73acsultAgwBAP3Excizfbm3/MCLz7eMCFM+5:vt4B23ESYfK3095
                                                                                                                                                                                                                          MD5:8F6E965A4FE38C5F1C35B6BB903F795D
                                                                                                                                                                                                                          SHA1:A4B0881FC2130B442DEF6D282882274450CDDC7B
                                                                                                                                                                                                                          SHA-256:BE488DBC62FD81FC486C94C9E609DCF0F7E0309E3C0D818B7B3A71A8EFF01739
                                                                                                                                                                                                                          SHA-512:960E5CF640D65DA8CADF7291C67F1B130C68E72E941672CDF274A6D2BD1142FFE035937E9FFD48F1A9C6319835672985025F2742EEFF466FA2A8DDC8DB2730B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......T...........!.........^.......................................................C....@.......................................... ...[...........b...............................................................................................rdata..y...........................@..@.rsrc....[... ...\..................@..@...............T........]...........RSDS..g..w.@......^.....d:\Source\SafeInt_V6.2\i18n\I18N\SPTOOL\VI\Release\360SPTool.exe.pdb................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):4.0244792826952365
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q++uNYCfqCfNtorF6+HVfLZHMf3HPC5NwuCf9HxmymJJv/1HFJCeq8SBpIfz:r+uNHB1C64K30e1bmymIV8i+b
                                                                                                                                                                                                                          MD5:80346C43EB48D20108874CE4F85E3D33
                                                                                                                                                                                                                          SHA1:A2A765E2AE1BE97C035B1E90D6ADF62C2A50E12B
                                                                                                                                                                                                                          SHA-256:65737D3B2816D6FAEBD813B9CAECE12721F58BD56A1477EBAC2DD4B2FCF8CB03
                                                                                                                                                                                                                          SHA-512:F701159750765FB59B8F385FCDEE80B23A86ECBA4C98634F3DEA6040A8498E699581AAEAE437A01C4970431D651B3B702F45B7E41E3EEEAF7B38A47AE46CD152
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=.M...t. .c.h.....n.g. .t.r...n.h. ...a.n.g. .t.r.u.y. .c...p. .W.e.b.c.a.m.....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=.M...t. .c.h.....n.g. .t.r...n.h. ...a.n.g. .t.u.y. .c...p. .w.e.b.c.a.m.....I.D.S._.T.I.T.L.E._.R.E.D.=.P.h...t. .h.i...n. .m...t. .T.r.o.j.a.n. ...a.n.g. .t.r.u.y. .c...p. .w.e.b.c.a.m.....I.D.S._.N.O.T.E._.B.L.U.E.=.N...u. .b...n. .k.h...n.g. .k.h...i. .t...o. .v.i...c. .t.r.u.y. .c...p. .w.e.b.c.a.m. .n...y.,. .b...n. .n...n. .c.h...n. .n.........I.D.S._.N.O.T.E._.O.R.A.N.G.E.=..... .p.h...t. .h.i...n. .v... .c.h...n. .c.h.....n.g. .t.r...n.h. .k.h... .n.g.h.i. .t.r.u.y. .c...p. .w.e.b.c.a.m. .c...a. .b...n.......I.D.S._.N.O.T.E._.R.E.D.=..... .p.h...t. .h.i...n. .v... .c.h...n. .c...c. .T.r.o.j.a.n.,. .v.i.-.r...t. .v... .c.h.....n.g. .t.r...n.h. .....c. .h...i. .t.r.u.y. .c...p. .w.e.b.c.a.m. .c...a. .b...n.......I.D.S._.I.N.F.O._.A.L.L.O.C.=.C.h.o. .p.h...p.....I.D.S._.I.N.F.O._.B.L.O.C.K.=.C.h...n.....I.D.S._.I.N.F.O.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):109056
                                                                                                                                                                                                                          Entropy (8bit):5.364999246920803
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:qORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE38:qOBrUC4jyUJGKzgSg+eKf5FN
                                                                                                                                                                                                                          MD5:7428608FAD09DD707035F242C0D8E346
                                                                                                                                                                                                                          SHA1:C596155945EC83BA907A2321C12F44854D3FDB12
                                                                                                                                                                                                                          SHA-256:7E699E7CAE94FAEF6D921221ED5DA5C12F40EE7A46A46802B584B52679650E69
                                                                                                                                                                                                                          SHA-512:1DAB36CD32B36D1615B3D659668EA0244E298CC883BCC420CE5884B1E52AC2B21AF28761D2B95A8A4F1197418AAD12FCB27CB129846A6603696FC6555FF374B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........n............................................................@.......................................... ...j...........r..h7...........................................................................................rdata..............................@..@.rsrc....j... ...l..................@..@..............2\........w...........RSDS.....P.C.A.....p....E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\vi\Release\360procmon.dll.pdb......................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):53368
                                                                                                                                                                                                                          Entropy (8bit):5.932195818912254
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:D3v+tnPKY4PWWYzpnD9UT1tFGHXjpjqrVO/rfroLotuu6ZP:8KJSpD9+1tFGHXt+R4r3uFZP
                                                                                                                                                                                                                          MD5:84422E85B69FC19673A307F95F7749F7
                                                                                                                                                                                                                          SHA1:D64CA005EFCCEE8A3560259F5E28B3E849F7AA0E
                                                                                                                                                                                                                          SHA-256:D1202AE5BBE15410D878214BA2F3A822DBC690FF0D4A5C9387524845BDCA616A
                                                                                                                                                                                                                          SHA-512:3A216483E034E5207E22D37A3075C113B06BACBF8BBB179B38A46E0533007AB0C2C9748F8D2BEDC24AE85A6D9C1EFD41FACB1A06CD00C5AB4DA3E8BF60E28889
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...z.U.........." .....Z...Z......................................................3Z....@.....................................................(...................................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21504
                                                                                                                                                                                                                          Entropy (8bit):6.867708761765966
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7PSL63YiRhI70HVJeMrwIHl9tDQKvrfpMQ3bZ5:L4iRaQ1FwIF9tDQwFZ5
                                                                                                                                                                                                                          MD5:41FFEC1B16391AE8180E3B7860AF61FB
                                                                                                                                                                                                                          SHA1:00F0C3EAE7B65BDD379AAF3AEBE7D1DEC8D1FC1E
                                                                                                                                                                                                                          SHA-256:5CA6DB7332607C2A3C4D7D1293FFE29D0F12C1A71B2C0069032B235D31D0E9DF
                                                                                                                                                                                                                          SHA-512:E07CB587F62C479BBE9295B7E3AA1D095769C24F594AF8E65F1A1E97F976B0D88097EE7B7750928E27005F500D9B680FD3B5807935A1C1645C08C3457D646769
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........................................................0......O.....@.............................................l...............h7...........................................................................................rsrc...l...........................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...........................................*.......................*.......................*.......................*.......................*.......................*...............................................*...........................(...8...................B........... ...T...........t...D...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.122818355343404
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7/7B608Za0YI7nOSeMlejpBA8nQJ+MQ3yUH:r7B608Zdh87AnJZUH
                                                                                                                                                                                                                          MD5:DFE0AAE9ACCA91C6F25CA8DB4FDD8AE5
                                                                                                                                                                                                                          SHA1:6B374F013337908AD2B29BDE29323C0FCB235398
                                                                                                                                                                                                                          SHA-256:129A724F898682A6CD98E3B710C0F8610495D890D72FEBC460552137524D3360
                                                                                                                                                                                                                          SHA-512:AA0658EF5C671F8DF6C23E893C9D9118F71BC2803D92811A3721DE894B9A6BC06D83C1DA97A7A1A937520FADC7C9963893F365FEB5BC8B1CDD8399EA7DABE1F2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0............@.......................................... ...................7...........................................................................................rdata..}...........................@..@.rsrc........ ......................@..@...............[........a...........RSDS.v...$.G..t.m......C:\vmagent_new\bin\joblist\259671\out\Release\vi\UDiskScanEngine.dll.pdb............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19512
                                                                                                                                                                                                                          Entropy (8bit):6.984609076947438
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7QhmeR3K+h1MeK6jzJJnDGPhCc8ov05MQ3W:s99K0MeKgXnDGwo
                                                                                                                                                                                                                          MD5:96C7A6EF9F82ECCE230F9557DD824768
                                                                                                                                                                                                                          SHA1:B8E6A1063082D7E6DAD487F31DEF4D09B83708B0
                                                                                                                                                                                                                          SHA-256:110EE1B3C8E43B36C0CDF3483768D8E1DA2126BA08A40C0A79324041D406FD29
                                                                                                                                                                                                                          SHA-512:80B43C6FF76FB217A2832FDA974C9EA99776C75C8FBE8037A308B7CE4613923A8F9BEB2652FCB6ACA6E10D9E30BC2B2B64A42208655516EFB2B01B7233D3DAF1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... .......R....@.............................................H................;...........................................................................................rsrc...H...........................@..@....................................................................8.......P.......x...................................................................................................`... .......................8.......................P...................*...h...................*...x...................*.......................*...............................................*...................................,...............8...........T...............................................P...................Z.............I.D.D._.D.L.G.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):54392
                                                                                                                                                                                                                          Entropy (8bit):6.254548736236842
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:4CG11xWF7Lp/El6Eh7lKlJ01O+6JWGjELBAS9RLN:FGa7l/8h7xoJWG4LBASP5
                                                                                                                                                                                                                          MD5:AFD72F3E8C139F63FE74B93DBFF61F26
                                                                                                                                                                                                                          SHA1:F13C1CE34A088E0FE5C2646322ACDF070E3DD0CF
                                                                                                                                                                                                                          SHA-256:D7D9621D627D93F9AFB6FE26084176B158658EF396EA3EB29679E85EAAA4C0DF
                                                                                                                                                                                                                          SHA-512:0F63E6FB659E603277497EB1083EB55320841D52DF3B0C7D8100AB72A81BCD2F31E6E9D8AD55A1D0AB77033A3A3024D101D16A2B157647998EBF0BF935BD2822
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...8.U...........!.....d...T......B...............................................mC....@.....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc...............................@..@.reloc..6...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.793224350479918
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7GMTvuGyMrj1grjzR+vnr9ZCspE+TMArb3ht:7GuoM8z7eMSxt
                                                                                                                                                                                                                          MD5:87FF93DEE950902AD30EC4E1FD04FCB3
                                                                                                                                                                                                                          SHA1:DD2A674D6AA6269CA58824A3819F635041C00B4E
                                                                                                                                                                                                                          SHA-256:A82957DB09C21550F709D71D8F6742C30B9CB7BF17C8D7FFB07DBAA7565410CA
                                                                                                                                                                                                                          SHA-512:7848388A9ADF387340260325735FB0119ECB1FDC4BC31906BC1068D38B76E6ED75490D89051A83D81D0255D7102198B7DAF69318FB7B4EBBEFA868C76FDFFB4D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ...........@.............................................p............................................................................................................rsrc...p...........................@..@....................................................................0.......P.......h...........................................................`.......................................................................*.......................*... .......................0.......................@.......................P...`...............................4...................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...T.r...n.h. .d.u.y...t. .S.p.a.r.t.a.n...T.r...n.h. .d.u.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.699630689832304
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:76MRgSyMrj1grjzR+vnr9ZCspE+TMAruqqG:76cgRM8z7eM4qG
                                                                                                                                                                                                                          MD5:596D51F844018CF3E37482FC2ECB7F92
                                                                                                                                                                                                                          SHA1:E6E3FA00A59E20FC904DC8E7A0562E94B547C67F
                                                                                                                                                                                                                          SHA-256:98CF3F3ED723492EDB93A00E805A30A50462EE6E6E5EEE1AF5455A5A85FAE10D
                                                                                                                                                                                                                          SHA-512:412DA5840A3778B5A2F077C0C45BE96C8C6C1A1849D5365EFB0515B5ED85BD49CAB22B281886C97540B64881D0FC45A02747587A0399B6462282B096F524BF3E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... ......u.....@.............................................................p............................................................................................................rsrc...p...........................@..@....................................................0.......P.......h...........................................................`.......................................................................*.......................*... .......................0.......................@.......................P...`...............................4...................`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...T.r...n.h. .d.u.y...t. .S.p.a.r.t.a.n...T.r...n.h. .d.u.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):486
                                                                                                                                                                                                                          Entropy (8bit):4.019281861119693
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:Q++ubxP+Qb0GQEclSkl4FhR4C+XgE2lHpmE9yqWZo8E9HHpZ:Q++uJ+QZCwt+XKTpWZqH
                                                                                                                                                                                                                          MD5:989119BE7FF6DF3C28F083245705884C
                                                                                                                                                                                                                          SHA1:CAF674D426D1F59FE02BC60DD9E8E23AD4A487B9
                                                                                                                                                                                                                          SHA-256:542C8AE02524028241A8FD9C375CF52D889C1970ED61A27E4ADAF18AF59BFD90
                                                                                                                                                                                                                          SHA-512:4DA88849CD4DB396235DC3016AFCFD120DA747EEA34F730AB8A980D89D7AB2D693AA95DE12451C240B44CA7C53E8617F96E9D05F08F1BF8094D8E853727F662F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=..... .l...m. .s...c.h.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.C...c. .t...p. .k.h... .n.g.h.i. .t.r...n. ... ...).a. .U.....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=..... .l...m. .s...c.h.:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=.K.h...i. .p.h...c.....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.T.h... .m...c. ...n. .t.r...n. ... ...).a. .U.S.B.....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=..... .k.h...i. .p.h...c. .t.h...n.h.:.\.n.%.s.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8564
                                                                                                                                                                                                                          Entropy (8bit):3.583044072778762
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVlAZNqWIajywapG4L8nzd6WSbJ1J9W0fsFWbmc:29+DgRgaz4G4L8nzeWLFWT
                                                                                                                                                                                                                          MD5:BF48841628746BECFEAD179C040EBF32
                                                                                                                                                                                                                          SHA1:1150814BBF80214CB88232B1265F09CD5CE64E45
                                                                                                                                                                                                                          SHA-256:912207642AF62C66516E28A4875E55897AB9D79F64A35A6FA5FFB00CF605B64D
                                                                                                                                                                                                                          SHA-512:1C50921437CC9A5950BBDEA75183411A86D0993B2691F1C080E1B941BBA2287AD86E1C6DF0D06BBF2FA93934AE8959157097D57A0D622626CA295DAFA39CDB5B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3054
                                                                                                                                                                                                                          Entropy (8bit):3.338192521658553
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsKg6PCabR:r5u5/+mMks5qTp1mNqce9OoB6aabR
                                                                                                                                                                                                                          MD5:C4D97AA0F9A302C66E7DA17CD90B32B8
                                                                                                                                                                                                                          SHA1:8BDFFCC12DAD54CA387F535A35BC7D7387AD2FFB
                                                                                                                                                                                                                          SHA-256:F668E0FEEB0090882CE24810467E48574530E9A356CBD739238FC4A1DC94C79C
                                                                                                                                                                                                                          SHA-512:C00617F526C2B350C2D1E594EE88D9D6F33D4001545FF46B53BABEBA5935A8B769CDB124608FACE72BF46397B0B71C863F5B6C6F15107AEC99135B182B0928D2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\vi\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9336
                                                                                                                                                                                                                          Entropy (8bit):6.728249808618724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:74yFNfT5T1GyMrj6rrjzR+vnr9ZCspE+TMorKGO8Z:74yFNL5rMCLz7eMpE
                                                                                                                                                                                                                          MD5:0FDEDF23F925021A4454665FBEDD49CD
                                                                                                                                                                                                                          SHA1:F550B8478AF8F61F2734E4E8009BD5D9C2704580
                                                                                                                                                                                                                          SHA-256:A4B8153F4E10ED786C980692B5B08259EDE3E45CA79B3F131339DCB6E22069B8
                                                                                                                                                                                                                          SHA-512:5848B9ACF881AF8603054C5D610449AC97130EB70C00EB69AA26476AE630A04BDBF8FC9A9EA4D12B3D70E2F412075DAAC90BD3760D289EC84455D96E01B3AA29
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....3.U...........!......................................................... ......o.....@.............................................T............................................................................................................rsrc...T...........................@..@....................................................................0.......X.......p...................................................................`.......................................................................*...0...................*...@...................*...P.......................`.......................p...............................8...........................|...................................x...............Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):81984
                                                                                                                                                                                                                          Entropy (8bit):6.820172858565741
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:smvblAch7O7RoWT13QQE90iloP3BPOJaRRjE3z:sB7RoY13Qf0iS88RRjE3z
                                                                                                                                                                                                                          MD5:CE615430B9B3D1BD9FDF3F622250DF38
                                                                                                                                                                                                                          SHA1:5D940214755DD00067B33822BF14F8DC86B74D76
                                                                                                                                                                                                                          SHA-256:1CA1038F4E177B2F459FC20A5300FC5CD1EB59E762C2FB015423372D64B31F0D
                                                                                                                                                                                                                          SHA-512:42A00A132A9B73F6A1F5BF8FB41CF36ED63D9C577AFB633A4960078EB5FF6427E0853C606D9AA81F750C9045D9086A55C707E8A8605230559C79827DB69254CB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L....H.[...........!.....d..........B........................................@......x3....@....................................(.......\d...............7...0...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc...\d.......f..................@..@.reloc..h....0......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1064
                                                                                                                                                                                                                          Entropy (8bit):5.0156762327808995
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q++uLTuhV5AD/PxLZV9mgFzgDe8tU5ZAQKX7RiWA8veZIM:r+uLTAVE3xL9mgNgCS6nY7Rq8veZr
                                                                                                                                                                                                                          MD5:7802B72235B3A53B9B2B365B9BC311C1
                                                                                                                                                                                                                          SHA1:2A94DB826D48716C4A743322DE0462872CE24EA4
                                                                                                                                                                                                                          SHA-256:94E04105121BDE7DDE10D505049E6582F9925B20A86ED639AD026FF45E440ED3
                                                                                                                                                                                                                          SHA-512:2B4A3F6502335EE809CF70A94F9AFCF7A902BF29D4F7F3FEFD7E857CAC4628E6B5E5753423DF5A494400A584F3F51E4B31D2243FB20B110E1C335FD49402ED97
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.3.6.0. .T.o.t.a.l. .S.e.c.u.r.i.t.y. .-. ....bJT....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=. .(W.L...z-N.Q.s.N%N......sS.\sQ..0....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=.1udk.~.`&^eg.v.N.O.b.N.m.aIk.a.0....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=..`ck(W.O(u.v.z.^.Q.s.........sQ..0.b.N.^.g.`..AQ...\....Oo`.S.V0R .3.6.0. .Q..z...N.^.R.b.N.f._0W9e..N.T.0..N.Oo`.S.S+T.Q...z.^.v.QX[penc...N.O..U_.NUO(u7b.v.y.N.Oo`.0....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.2.=....`Yu.NT..|.e._(.Q.Q./.M.S.N./...O)..N.O=\._.Qdk......I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.R.E.S.T.A.R.T._.C.H.E.C.K.=...e/T.Rdk.z.^....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.A.U.T.O.S.E.N.D._.C.H.E.C.K.=..N!k.N.Q.c:y(..R.S.....bJT).....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.S.C.A.N._.R.O.B.U.S.T._.B.T.N.=.kb.c}..V.u.k....I.D.S._.S.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\LibSDI.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):99652
                                                                                                                                                                                                                          Entropy (8bit):7.998108225602368
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:Cu3o3CRwNkJxpJUXL02yzqwjda/oE0rjdILDVD:jDQkJx3FqwEgEOjEhD
                                                                                                                                                                                                                          MD5:3215976C24BA3EB83A117E2FF7E08260
                                                                                                                                                                                                                          SHA1:EFCA10C91A9DA623FE89DCB0A1B4AE9A9B380832
                                                                                                                                                                                                                          SHA-256:3801877FC8ADB39B8F8F2ACBED243D13A4C60BB75F56C91529DB5C1B7617E540
                                                                                                                                                                                                                          SHA-512:333B9EE21856AC6155A0B36F4C2AFAD3B4E3CA3713C65A6489921A9BDA20BFCBCE71BB14D64344D654051D0E708A6565623EB4BB5CEAD42926F16C46053B8E1D
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:Ix.6C.....a.J.......hu.{...0D.)..}F..Y.....RG.7..e4...}....=...0.]J..@....5}.ir..l.Kx.J...yL..r. b.*..#....x...o....'.].m0?!.|......a`].D@..T.U.e..F.J.#.0.m.X...U..{...X..*...t*Q.p.y.....~.`.d2.CuE....-B..OB..{..r.\...,e].IGN.Z..*F.}k..7...<N..&.pA .W..SP..x4..z..M.2.:.YN.I.G....C.l.rg.n...~.B7..X.D.t../.Z..........N...H_...s...)~.........c....5w.dp....i......./oo9v.|...6.......9~OG..mdh......TN...6.E..(l.*G1l..J..M.{..u..F.d....j)...,..5..:]....s.c....dY.....rq./.._f....Y....z../#nX..........M-..{.F.k}.D.5.....8.A.s?.(..`.8Pi.=......x. t.....F. 4..F3.l.V....E.r.....h..8v3h=.#6....VS..b.U....} .....ES..i....q.'.8.f..k`..s..U.^-......+.k..c.w..Ro.....E..Y(...3...C...<Q..pu...dE....R ....tO...)...>p.l..E..&.?.......V.>....C1.Pk ...w...y...V..mo.!.(...$9:[.1....'_[...^.HN.vTCLn.y.V...m\.}.l....B.].....K.m[..#W.G).aU...u.....=m..=.......wg...I..:....F..@......|U.....e.}9.....;.*.D...+.}.I...%.../.-y.j.9....S....dy.4....*.2x

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.615788105044282
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7xItGztDGtutI7nOSeM1EjeZA8nQJ+MQ3Ss:9ItiDGtXJaeZAnJJs
                                                                                                                                                                                                                          MD5:46FF9DAD86F284B182A80AB2D2873DCC
                                                                                                                                                                                                                          SHA1:78C6C607B61E88520C8B2F9E54EC564806EF6855
                                                                                                                                                                                                                          SHA-256:83CFE76C1F67390F3E6EC7D98B56F95C3ABE88E7BDF440DF7AEA73623B235E58
                                                                                                                                                                                                                          SHA-512:CCF035CCCAEF2EFE1E2B5AAD0A4B1BF52869E91A0B44C3A1EADFD52C87AD50E4817ECAE5046F73BC63FBE9CF5D09AB7CF447536A196F7A61ABDDD84A00AE5EFB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...S;.[...........!.........................................................@............@.......................................... ..(............ ...7...........................................................................................rdata..|...........................@..@.rsrc...(.... ......................@..@............S;.[........`...........RSDS..!.,.GF.. p.]zF....C:\vmagent_new\bin\joblist\258920\out\Release\zh-CN\UrlSettings.dll.pdb.............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75320
                                                                                                                                                                                                                          Entropy (8bit):6.800542006651688
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:N2kLlARh7TYRobdm6m/mNXDLaBS9we79:N8YRohy/OHt9
                                                                                                                                                                                                                          MD5:385714A0B2394E1170922FD2AB9334E1
                                                                                                                                                                                                                          SHA1:7111DD0CDEC143D5775EF18109E294D8B3DA1C01
                                                                                                                                                                                                                          SHA-256:22D8B2E34D15EB411AF820A4F2A8C72292CEABE983B6B83E6D75CE2185383916
                                                                                                                                                                                                                          SHA-512:D69BA1393AC6848500D0DFDB4522CB5F455A20DC8EF9351D6015A6A59B1A669016D81FCA1A11D9B6251A48AE48A4F87F3FB8953E24FADC1220A67B83B2AFF26A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................ ......QV....@....................................(........F...............;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc....F.......H..................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):68184
                                                                                                                                                                                                                          Entropy (8bit):6.7067985976880555
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:vWPrlAMh74JcFRo7du8Im6m/mNXDpkBA0N:vlJcFRohu8Iy/ONo
                                                                                                                                                                                                                          MD5:D73E159CCE442BCC09A31BD3B5644DF3
                                                                                                                                                                                                                          SHA1:5C9DA18F04534053B752EB0FE1D1AA1702C2DDAF
                                                                                                                                                                                                                          SHA-256:8934829166EB2AE44A7DF7863A93CFF3E97862D3BD48B6212075593B83F09BB8
                                                                                                                                                                                                                          SHA-512:521D008420C6F104B8EDE621B37B8BC577D674F4E0AC99AB9D215240574D76BD0CCB34804FF4EFB94B99DA78BEAB5B94AEE2BD2366A4543B060E0129D0187C60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L.....-V...........!.....d..........B........................................ ...........@....................................(........F.......................... ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc....F.......H..................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):68664
                                                                                                                                                                                                                          Entropy (8bit):6.7751267328251545
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:qmvblAch7F4Rolm6m/mNXDNdyBPoV9we2:qe4Roly/OHjV9i
                                                                                                                                                                                                                          MD5:0FFFF63842AA37607A6BD11CEADF981C
                                                                                                                                                                                                                          SHA1:239584D3B0CF9D71299898019FF76FCDA7AE374B
                                                                                                                                                                                                                          SHA-256:2B746128C1E11332A2CC50E6260CB0A70F4542B08B0431A6D1A0777BB7F8D33A
                                                                                                                                                                                                                          SHA-512:1FD054D2F8AA75441A5383662E848BC395ED158F49296DAFB6AB5F5D6D7E3C933E17A2B51594A16779EE825F661EA534B3ABABF9D18D4FD318A3D0DAAA0F59BC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d...f......B.....................................................@....................................(........,...............;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc....,..........................@..@.reloc..@...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\dsconz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19012
                                                                                                                                                                                                                          Entropy (8bit):7.990164460525742
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:384:lAG4SpbActshMBk2FGu9H50wh690PFzIWJugWXcE5tcvlkKU:5bAcSG19H50S5ccE5tcvCh
                                                                                                                                                                                                                          MD5:F47EA52AB767CA8801D0D57B03D2212A
                                                                                                                                                                                                                          SHA1:4422D6021DEA724EB983769FE5F081A54B2CE775
                                                                                                                                                                                                                          SHA-256:B3A80F601BF98B4F1EBA317B1B02F1F9151112025FB0A4D869E95327A801FF52
                                                                                                                                                                                                                          SHA-512:57C8918805E5E1019435242E788A6C7F2305FD55ADDD699A4EAD9A990D50063594FBEB28E7BA621D70DDACEEF764124B957103817FDB44110214F0717B244CED
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<................J.../.ip&.....f........L................LLLD<jHLLLLLLRLEL.... ..{.....5lG..]jo.{[T....._.... ...B.+C.|..D^..H..R`.I[...BM....9.~.x.N31...pK...U.O..''z...w...XA...P...5X..nP..$.DdP<VdF.`d.V...&....h.y.b]7..P}...~..3..3...[c....1..s...[............j.....P.v...i.H.t......d.4.Q.V.KJ%......q....j+.3...b.i..[.....8...Sdy.....L81Dw5.9.%...9...5..!yk..H.IV...6.q.VW..G.3{&)E..{. ..v|K$.....E.gC@a...<t.....cy.4...~..r.$bH.Y...L...F..gN..O....6p..We..N...r{.9..;=.%..O..%]=..J.Y=#...//U.=>...F......G^........p.........c%.a.I#...G...8..8.or......!....o.S..6...L......1.c..CM.m...R.^.[:.@.0..6.j.v..A..#.&..+-..C...E.}./T...>...F......C..A...<^k.{Q,.2xaU...C%%U..m.....<....D....@.~.p......D...=JJ..q.G@...It...TI...?~.._._%5...L......ns.Y..k.....g..............XW7..CzZ9....ce@..M.....d...H9qB..J.%.......t...(.t.....5.i.2h).jK[.B3.\U.hW...aR.....sN.>..B.I:...n...3.U'.3.2.&......%-...dSM.,.Zx0..G7....myc....l...,.=.;d..f..l..|...!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60167
                                                                                                                                                                                                                          Entropy (8bit):5.515243944816979
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:nAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAS:RM4A6UAHRHF4aI7
                                                                                                                                                                                                                          MD5:24C596E28E6C10C7BF234A36FE6E3B90
                                                                                                                                                                                                                          SHA1:9ECAE6107368153CD3C61B9F2B8EB9ED0939ABEE
                                                                                                                                                                                                                          SHA-256:144FB28931E64D1B631B53202703D2C25665FE47F18904BF03998CE0B930D18F
                                                                                                                                                                                                                          SHA-512:FC5C0AB20FEF02B84FFF06A08B87177817C2E64DF69CC0F2761A49CC6681C756FC313AB7CDC902F7B5ADB49D5E4D6ABEA4A4E822F51E56F44B0F3BC5E8729E3E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<.......................................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.521582643974709
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GV+kBGnSWNvseoWiO70N+AJ1ReA5qCbXgJuII4vOvacP:IJuZvseXXE16pvOycP
                                                                                                                                                                                                                          MD5:92557779BF8B94BC5F575DD8DBBA9503
                                                                                                                                                                                                                          SHA1:E3F5F0BE37F0FB763614874704C487C895239592
                                                                                                                                                                                                                          SHA-256:E9A79EBF0049F940E2BA767F517A89EFDF722D197E992B4A3E1316A57AE91BA0
                                                                                                                                                                                                                          SHA-512:9C80A8D52802958D086AD89B2D5818871BBF286AAD232CE99BE3B1E6FFE7C76FEA937529DB0970DF159712FB488D7C31591540AD46277A119985821D5B593D7A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............`!G[....d.s.u.r.l.s...d.a.t.........................................................B...8...|...........t..^..}\...n...m..&xjx.#.o.5.u6......i..n....eg.......Cf.."bK.>.......K.=iL...;....^.>>0....0.'R.)......Y|..Z..D... ......$..T....:x......{.iN.x\.H.L..>..[......1.o..V@s..............A....Lw.....A.!........f..x..).......%.C`..>..1<..(6D..%..Y.. ...W..a.k{.&...fm....OB=....-.0.!U...>.RQ...Ov%~I..<.p..| ..*.2..ci..0.*.....2I.-G..T..P.Q.xq...r.L5 .....E.g.=n........[.RT.G.sc.B..e...R.P.......].....:....2.4................eTX......(Q...Fm.M/........Y...3...^>d.....i..Ak..L.*...)P...Q....:.v.m.k......!y...F..s2..dR3.yL..E....S.....a.|...nw.......A...kJ...P.I< ^./.-KDQ.5..kAI"s.T.K&....K.@6UZ..`..?.....dK.m.j5.....I8v.T.b......wI...g..@\..]O....&..'.*<.]4m.....W.....G.O....x.-.1yf..=4....Q+..........P.1..S%.^2...[....ps...Vs..k.Z..<&...nr..K_...U.1.]...WM_.1..{..U...-@.../....WZ._.}.l. e.-.6t....]...}... ......)..d..8...!*s...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\deepscan\ssr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):45304
                                                                                                                                                                                                                          Entropy (8bit):7.993652940859545
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:768:shlkKTYFz88W2NnYss/5KgeSfBdDt5OM0j8CDzz/KneR2w6R/hcX2VC:4lkLFzpnYssR7r5pt5O1ZDK42xA
                                                                                                                                                                                                                          MD5:24D399A9DD5C24B193F574CEA7913C56
                                                                                                                                                                                                                          SHA1:52563BEFDCEF45E38E1F5C2B626A9091951DD535
                                                                                                                                                                                                                          SHA-256:7CC8342E5FFD96E3506559156880637ED49DDDB44B05CA4127DB6C76ECFE1078
                                                                                                                                                                                                                          SHA-512:EE53DA1D8ABBC69C7E23A389633520A8D7DCB0F1129A80D125FAE6DEAF47B1A834AF270C82BFF54DFFF091AFB26694601E1A8A4E63D52FB5BC3D8FCF2B2F1804
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<....................9nd.....<.4........E...............=..,6...c.<..z. ....d)a3..~v.4......v.mS....i...`.X..h..l. ..........w./.j..o.........gDa.E.3.R..GwZY.<...b..8.......v...^N......8...8.s2...S..s..........?....]..{;.{.}z.*q........:X........[..........{....*...w:By...E.......D0.ir...c.....}..s@D.........".0A..n...0.=.(....j.....sj^j.....Ro.j.........L.O..z...w[y........Z.r.......n&66......h.(...8.7.?.}HD.r...........j.Rq.p..........6.7.....M.<...O........;.T^.:.R1[.q.....R2..f.....c)...s?]..\.p.&>...v6Z.(..........V.ppv.<7[f.r......%.n.2....4.8.@./.SA.......3../(.....v.../.".6...|.e.....0....8.....?.f../v./...h.. 55[j........qM....z..i......0.,.}.+9-..~s.*...m....6.<>.I;.f.c.6..l=....UJ.."....~.J..+...V...Nh............H&....U.:...V.......N........R....7.Zz...P...QK.j....<D.y..Jy..L.flZ..iY.....Yi.k..X.S...................z._qO..g...d.g..E.8.].u...0....G......Gn.rM.f...AjQ..Gw.g..u. A.Gd<..f<.U.C..vR..!..V.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21568
                                                                                                                                                                                                                          Entropy (8bit):7.090935254461522
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:746NciJm+/U65pbKI76eR3KJ1MLfp6DGPhCcYXQKvrfpMQ3ygi:RC65p9b9KvMLx6DGdyQwcgi
                                                                                                                                                                                                                          MD5:EB5BE74C35C493613D9742A729BF8CCA
                                                                                                                                                                                                                          SHA1:1AF1D062D3A10A2F14BBE416FC694E35AB19B49A
                                                                                                                                                                                                                          SHA-256:0EDC6FAD1B41B129854021A1256C0B1832E164E3676FBE377BAC94B79798E5F0
                                                                                                                                                                                                                          SHA-512:8D72A118B9590D4A1C2061CD0A6EA667DD059A36E5475FA3046D9784AB89EEA7F267F240652CD9351253DA66CC0077633E1D43392FF4A5AF509670C70AA143B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........................................................@......8.....@.......................................... ...................7...........................................................................................rdata..|...........................@..@.rsrc........ ......................@..@............. ._........`...........RSDS....7C.5.........C:\vmagent_new\bin\joblist\503376\out\Release\zh-CN\NetDefender.dll.pdb.............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49272
                                                                                                                                                                                                                          Entropy (8bit):6.381386119908231
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:ay2lF/WFLLpAEl6Zh7laV5tQ01xtY+6JWbrdvNBMUr1fE:z2kLlARh7IGJWbrdvNBMUrm
                                                                                                                                                                                                                          MD5:532D591EA1EC4D0DBF7B4EACF534D91F
                                                                                                                                                                                                                          SHA1:C8499CE81B27E96E9EF0EBC3C9A05E8D6530BF00
                                                                                                                                                                                                                          SHA-256:C2F8E01F4058FEDE2A926B21524ABFA00B5C0FEA0C3F71F595959F0E2F4381BB
                                                                                                                                                                                                                          SHA-512:B840E80185C36FC7680BD9DCAF9524AB8600834DAB28CA8E486BF9503B3D5E6A67F94B669EED3A76533FCF582F9815E466E12C0DA4730DC5DE7E741A014B6422
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...a.U...........!.....d...@......B................................................e....@....................................(.......4........................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...4...........................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):47736
                                                                                                                                                                                                                          Entropy (8bit):6.077137689810366
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:KXHGdBPASgYoH6dzSnq5TmtzG3TpMtaBV7s8lAKYQ7rtAMgZt:LASgRcSqNmtzG39MkbLAUrtNgZt
                                                                                                                                                                                                                          MD5:C3D3AE517F69E19E104D9FECA5028F42
                                                                                                                                                                                                                          SHA1:42B9EE20FB53A2E9DB131E35073AF5C4B9BECA34
                                                                                                                                                                                                                          SHA-256:630EC25361ACA83CAAEEB845168AFE4378E7A058C27D375A604491E576D69987
                                                                                                                                                                                                                          SHA-512:36BA5B385BC52B15C9F63864173A3C8432ED6FC17F474EF25A8877E4B6671BD76247280029B1F3CCC7178CF7A137EB7F091CB8DD879BCDBB8D29D25AE3F6EBCF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...S.U.........." .....Z...D.......................................................D....@.................................................h...(.......<...........................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...<...........................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16864
                                                                                                                                                                                                                          Entropy (8bit):7.0515395619395065
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7zKjVHsT3EXnM6ki2cP0iwfLDtxdqS+ShjmM6IGBkSCe:XKjOTgH2cPfwHQS+ST6nks
                                                                                                                                                                                                                          MD5:61D09876B8AAD824072BE2E32ED75250
                                                                                                                                                                                                                          SHA1:325C6FC5AA47ABC102CC9E500B34CC422EA7F11E
                                                                                                                                                                                                                          SHA-256:9E40FCC5ECB43CAA3C9A75612EC4C09235CFEC4EAF194251C2EFCD136562857E
                                                                                                                                                                                                                          SHA-512:C0FB76A4897AC087F34762634514B75E816D9F9550619648FF75487C5D26669FAB852FACA4C0489F1D6DFF6F75C69BF51A742CD9EC93E32A19193B4F95B9BE9B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@......2.....@.......................................... ..................H)...........................................................................................rdata..u...........................@..@.rsrc........ ......................@..@.............#pf........Y...........RSDS.M.....A..9V..d....C:\vmagent_new\bin\joblist\815456\out\Release\zh-CN\appd.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\appmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):31884
                                                                                                                                                                                                                          Entropy (8bit):7.984182760263082
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:u+zLCxgl+NgTv7KjzSOW0W/76px1IuBOUPKVlr5So:u+zLCoTv7Kj+OaT63VOg6r5D
                                                                                                                                                                                                                          MD5:D6E926B760023F832EE03964C76C8BCA
                                                                                                                                                                                                                          SHA1:160A3C43DF81F0E3F7EA6270AEFE5DD0AAA8D9B2
                                                                                                                                                                                                                          SHA-256:4F615CA4D4273077B95EA8A9E5171C284B0B5CDCF00AA0725C3958BFCE1E3F00
                                                                                                                                                                                                                          SHA-512:4264C8BCFA496A1FA5CE9D068FD8BA9DF29D6AA8A78CFDD2EB7491A34E341570628546F30FE45B8984319E1435A0CBE7EBC234851954EB92487FB96ADD176BCA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5................................................................................................................a.p.p.m.o.n...d.a.t.............................................................................................................[d./....................G..P......D2..x.hF...b.a...O...Ob6....n.;.]@R..NhW..4l.....T.}.9....8.N1gj....3#-)....f$.S........#..w%..w.`...0....4..............0............4.:....o...#I9..7.B...g..U>H.......N..-!.$_..p...\...T..tw..)L..).q0..E.....I.T.F)LK.T.F.|D.2.1.K..9.l.7G..#ns....u.i...b|<..M.v=."..d..li^`...7..k...4....P...W../...m..K.....E..s.....J.a..........P.v.p._..2...l...Ac.\.q.....sO..(./...V?...v...3Bc...:.`.[A.%.........>|8..S..p.2erpX...gyH..q/......;.>X.]..n^{. ..r..p.e..tq..v..W.m......cm-..T..#SVc.../S......}..O}.=....%.C..L...f7.A.<U.<-1.p^ .f..U.!.t..|..#.....w.->.q\.._......LG....b4...v.VG....C....."t~U.8.l.xY.........e..p.....M(S......{m~i..f....F)..hNY...z

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):7.000344223233669
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7SRWpEB7jd3Tw6ki2cP0iwfLj18S+ShjmM6IGBkSm5:Guq7jd3Tj2cPfw18S+ST6nkL
                                                                                                                                                                                                                          MD5:B682B352E8B5300C54BD0BF08B82BB9C
                                                                                                                                                                                                                          SHA1:8DFD685C0E23B8AF0882E35F9D31059A58413825
                                                                                                                                                                                                                          SHA-256:678BC524D4DEAC92F9C1D21F088FF147BAEA7BE86467C9F7BF1AC27BA2139EA9
                                                                                                                                                                                                                          SHA-512:4CD2B243BDA418E2AA477E6348791EBCDFCAAE9CBD750B667DD915BBADAD241C491A2A584FBF10200F8B7E051B8D0CC475B52AE56F891A87711889FA3099B068
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@............@.......................................... ..,...............H)...........................................................................................rdata..x...........................@..@.rsrc...,.... ......................@..@.............#pf........\...........RSDS....<..L..h...XF....C:\vmagent_new\bin\joblist\815457\out\Release\zh-CN\filemgr.dll.pdb.................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17580
                                                                                                                                                                                                                          Entropy (8bit):7.967355526145761
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:WEPVsHzNzx9f2XWcwB3Q8faGr6d3Falqphu3zzlvNyl:AHzOI3FfaGr62lhzZ4l
                                                                                                                                                                                                                          MD5:CBD05F2AB56AF07555538DCE60667AED
                                                                                                                                                                                                                          SHA1:B19C8538426B94B57C57B9875951E95F1E950496
                                                                                                                                                                                                                          SHA-256:7CDF898BC364055FADCF60F797E09F010038B0889255042897BA1110A49C3C1F
                                                                                                                                                                                                                          SHA-512:29F33DF12B755D749F86DBA89D1B6D2AC1E57D160A5929F13CE36736814F64C84B421A6265F855F8681F2F8278C6F5E42116E693149FDEBAD8CEFA4EE115A6F4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5.............................................W..................................................................f.i.l.e.m.o.n...d.a.t.............................................................................................................!A.......Nu..9.K... .M%....c@........0.O. o..P.....-..G.(?.<.._W....]...@.=J.H....)a{M..jw.d....c....nb........[...f..|......#..w%..w.`...0=.|.........;......0=...;.....p...|.A...D..$-a.z......)(...o......#X...e....$...o..N...9.r.....L......|./....{..R&.Em.W...60u..s.\f.....6.ur.E..72 z.r...c......wK.h.Q6[r....$...s4.!?PN)..);lr..d............&...@^...b...g.tc.`.%. ...J....L.....$.C...L_d.[.4.'[.f..&'jt.>P...3..we.....Mb...._.C....T.,..Q..6-....)v..gb...&4.l[^.....s.v..n..........=.(.}.vB...s.....(..>=...6z.9..+ly...}.KW..Q?.i.=..n)..%..S.....u.....5.e...O...'{..!N[.I..n...^.W.\..y.......R.*.. G........G....y..G.x7Hc..ou...7/....... ._..`..qVUN..../.).wP.3.z.R.,.p5...n].h4./...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):33052
                                                                                                                                                                                                                          Entropy (8bit):7.988006737201873
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:Wh7Zn13gjjO34HtNHUhhX68cZHev0+1sDxbWQQHa:2913ey38NG1sS5IbmHa
                                                                                                                                                                                                                          MD5:4289A7DD80381EF11D926AF272BEC678
                                                                                                                                                                                                                          SHA1:B7E3CB3E5CC45CB2E11D856FB57F06A7CE9D789A
                                                                                                                                                                                                                          SHA-256:0BEF1695A753FEEDA8656E32F16578F4CEF1B8B5680F9CDFBF321F0AB81F658D
                                                                                                                                                                                                                          SHA-512:29B82BFE056E394C8911F730F2A2C6AB96858312347275FE6E90D739C1EA0D16CF5578BEA93C4A96572FF9A51D967B440B84574F804C8FE744962150852890D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5................................................................................................................r.e.g.m.o.n...d.a.t.............................................................................................................i.......|H.-.`......!..\>../.If.5.D.P.|..M...a5Tkr....M....E.|.$^.=vh.w[.Orj...Mr....8.80xQ...`...[V..V.R..P.....$r..e......#..w%..w.`...0....?..............0............?....C4*.V.....[....*.RV40(E&.AOc....... J...2..gC.X...>..q#.....5..l.....z!..N.R.V..W.*..(@..}.j^...[.,...^...J....;..3.j.......9$.~g.|kcH.[].....;.7>...}9...;....r.^x6 .d..|.....i9.?..1@....o..:.Y...N.3B...T9}.PE*..}O...0.K..ej..Yr......(G..@6TZ...l...o.........A.L.k>.!....?..O...g^u.u......X\.4...]U.u..qt..M+.d-`...dgSy,..^.H7.M...........z...._?.l...;.|J.|...J..>..u...T...T.......GO...........6..@9.9..:.+..P...'...V:[.A..kK.....dr...V....K...E.;vPXJ.\J.........D...b...e(..N..j.DQ..A_..~..(.Q.aUT....b-.[

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15328
                                                                                                                                                                                                                          Entropy (8bit):7.208267387593834
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7ORaQKq6ki2cP0iwfLezLWtS+ShjmM6IGBkSET:iaQC2cPfwRS+ST6nkrT
                                                                                                                                                                                                                          MD5:3B5C4F465909E3E7A8F1E0856CA13C48
                                                                                                                                                                                                                          SHA1:F935BF53E03A7B0B9882700780524970CC8F9ABF
                                                                                                                                                                                                                          SHA-256:CAC3A89476D7DBFD9E13D14F69A9C4F848EC3464AA28312C031AB49D85C2677F
                                                                                                                                                                                                                          SHA-512:3B4FD4A03784F5034E055D091D58307BEAE1EB3C190A2177DCC1F7EDD10DB1B6C093180F53EBAAF2AE62123B7637C1AD42A1C0ACDCEE765222FF0469EFC4CCE1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...^frf...........!.........................................................0.......3....@.......................................... ..................H)...........................................................................................rdata..w...........................@..@.rsrc........ ......................@..@............^frf........[...........RSDSb.....@............C:\vmagent_new\bin\joblist\815994\out\Release\zh-CN\yhregd.dll.pdb..................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1022, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1046528
                                                                                                                                                                                                                          Entropy (8bit):6.807998326858681
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:kMYC1Y3/1UI43ITQjnOgy4gMFbaB8B3puYhvcs:9AN1437jnvXNz
                                                                                                                                                                                                                          MD5:562C352762BE3FD61F555C31BB2436D5
                                                                                                                                                                                                                          SHA1:CA841D9FD4547C274275A2684FEC535A16DDB7BF
                                                                                                                                                                                                                          SHA-256:F0DB97D434B56ECA598735A5817264B299020CF87E639C41A7B04FC6DA5D7470
                                                                                                                                                                                                                          SHA-512:BD5B5F7C91449B9AB186ECAFF0ADDD66C0FA00772A1310CAF0864ED79592215CD6C2DDE71F28068D58192CCAB566E5619375C69E4FFA9A0762118BD8C3C7A076
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007009, page size 1024, file counter 262, database pages 791, 1st free page 13, free pages 1, cookie 0xa, schema 1, UTF-8, version-valid-for 262
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):809984
                                                                                                                                                                                                                          Entropy (8bit):5.82778812518279
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:ejt5CQRUdpa9hnysVBhXRn1yZBjHYgCuosZUoQH2ul:wCQRUdI9hnysVrN8BTYgCuxUo8
                                                                                                                                                                                                                          MD5:70647D27F50BE853FEF0C708C751D13F
                                                                                                                                                                                                                          SHA1:02EB7D07965635FD78427887556595F4545859DA
                                                                                                                                                                                                                          SHA-256:F835DD6EC6838A82C8BBB6A9A3F3BD203E25D99AA144610C3A9FCF71C18F440F
                                                                                                                                                                                                                          SHA-512:1203D42DFE7F605044EE73B038AF4CFAB768DA9C4A5B715BF89378DDF327FE1471D58A4EB97A2DEB95891C0A20FE1389007D1BE90A8B39B3B43461C87E3FBAB6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.!.................[.....W............................tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main.....>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).).........{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):28792
                                                                                                                                                                                                                          Entropy (8bit):6.174855815772824
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7Z0acsultAgwBAP3ExcizfbxgLvfM8z7eMA1:qt4B23ESYfFgLvUn1
                                                                                                                                                                                                                          MD5:B73BF2C7450765792F75B6BF32806542
                                                                                                                                                                                                                          SHA1:FFFA7ECC269731A968400BC45E131B92594D3D01
                                                                                                                                                                                                                          SHA-256:31C368237801E595526A7C13371C04E7B4C3F9092CBA22AE80894430FB327C90
                                                                                                                                                                                                                          SHA-512:FBC882B3EC8256E408628F02DBEBE835FD99807A5DB8E5CE33574F39A5C68DB5D45A9D21490EE9061311F3FAF5644D61B7452874055F732C22502D4F11E6BC8A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....V.U...........!.........V......................................................9|....@.......................................... .. S...........Z...............................................................................................rdata..{...........................@..@.rsrc... S... ...T..................@..@.............V.U........_...........RSDS....c];O.....V,.....D:\codebase\SafeInt_V6.2\i18n\I18N\SPTOOL\CN\Release\360SPTool.exe.pdb..............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1312
                                                                                                                                                                                                                          Entropy (8bit):5.165571558531891
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q++uNyxABhZ+h5e9OQvw2u+bwJ5CsmSHLxtHFvJ4+xN/Lhq6XwhR:r+uNym+TeMQvw5+bwJ55jHLHr4+fo1hR
                                                                                                                                                                                                                          MD5:90F56778FB26F0470DFF604BB7C752F5
                                                                                                                                                                                                                          SHA1:2198B276CF24FAF5826EB64D7607C33E1945F501
                                                                                                                                                                                                                          SHA-256:0DD85F897C3EC777BF7E7BA56A2C7F81E5D75A5918B2A7E316B207A01AC78A14
                                                                                                                                                                                                                          SHA-512:A578E5587B2F629BDCCFBEA2D6A7928D9D8CB531F22FF2303702E68341F735D365B15248715D6A44A69C08A83FF5E527ECEC6FDDE1652F2C1EFC6E70F3920E31
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=..g.z.^ck(WSb._Dd.P4Y....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=..hKm0R.g.S.u.z.^ck(WSb._Dd.P4Y...^..;.bk....I.D.S._.T.I.T.L.E._.R.E.D.=..hKm0R.g(gl..z.^ck(WSb._Dd.P4Y...^..;.bk....I.D.S._.N.O.T.E._.B.L.U.E.=...8^..[.bv`.a.z.^.S...OwPwPSb._Dd.P4YwP.z.`.v...y...Y.g.N/f.`;N.R._/TDd.P4Y...^...zsS;.bk.0....I.D.S._.N.O.T.E._.O.R.A.N.G.E.=...8^.S.u.z.^Sb._Dd.P4Y.T.OwP.z.`.v...y...^...zsS;.bk.03.6.0..].~.^.`.f\P.N...;ub.....MQ...y.l2..0....I.D.S._.N.O.T.E._.R.E.D.=...8^(gl..0.u.k.Sv`.a.z.^Sb._Dd.P4Y.T.OwP.z.`.v...y...^...zsS;.bk.03.6.0..].~.^.`.f\P.N...;ub.....MQ...y.l2..0....I.D.S._.I.N.F.O._.A.L.L.O.C.=.AQ......I.D.S._.I.N.F.O._.B.L.O.C.K.=.;.bk....I.D.S._.I.N.F.O._.R.E.M.I.N.D.=..N.Q.c......I.D.S._.I.N.F.O._.N.A.G.T.I.T.L.E.=.Dd.P4Y2..b....I.D.S._.L.O.G._.O.P.E.N.C.A.M.E.R.A.=..z.^Sb._Dd.P4Y....I.D.S._.L.O.G._.A.U.T.O.A.L.L.O.C.=..RAQ......I.D.S._.L.O.G._.A.L.L.O.C.E.D.=..]AQ......I.D.S._.L.O.G._.A.U.T.O.B.L.O.C.K.=..R;.bk....I.D.S._.L.O.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106496
                                                                                                                                                                                                                          Entropy (8bit):5.42082345369655
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:tORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3b:tOBrUC4jyUJGKzgSg+SW9CFx
                                                                                                                                                                                                                          MD5:FAB30AE7EB5C4D4BBD5D67E0391D53AF
                                                                                                                                                                                                                          SHA1:48F84646D2858B614494B86F8B268A326F902319
                                                                                                                                                                                                                          SHA-256:500D01E83B0DB58E90DFE8BE9C9C99D3805456D6EBAF95D0B782D51F649712D5
                                                                                                                                                                                                                          SHA-512:AE01386989ABC594E12882AE2FF04506007C1ACC63491EC77CED3FB8B135EB7C8FE84F2B0CF2E124C5C1A0A3F95E7D337AC015FE3488B4BBE2D5772F82E440BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........d....................................................../.....@.......................................... ..x`...........h..h7...........................................................................................rdata..............................@..@.rsrc...x`... ...b..................@..@..............2\........z...........RSDS.._.`.D.d.O..w.....E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\zh-CN\Release\360procmon.dll.pdb...................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\Safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):51832
                                                                                                                                                                                                                          Entropy (8bit):6.384896186956117
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:bCG11xWF7Lp/El6Eh7lKlX013+6JW75gi5BALjorknK:GGa7l/8h73lJW1gi5BALkrknK
                                                                                                                                                                                                                          MD5:97C001DCF5972A9BF5F889B4CB9C20D7
                                                                                                                                                                                                                          SHA1:0E29AA7BEDA72E5A2D14513ECBA05AE1C0E9F55E
                                                                                                                                                                                                                          SHA-256:6DE3EEB6FC048EACE57F847D0F95AC7B6EB5A464D4B57857022CF68AC1546DA1
                                                                                                                                                                                                                          SHA-512:1BFAE3A1EB78D644C9458CC0712C44E37A6D8C330C06F14909DE10C963611063B44D1C38EDD2A9676530322C604869344F775B04AB3397D34506EB266F2AA2F2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...;.U...........!.....d...J......B.....................................................@.....................................(................................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):50808
                                                                                                                                                                                                                          Entropy (8bit):6.059126765069665
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:83v+tnPKY4PWWYzpnD9UT1tFGHXjpjqaVf/rfroLoE5gRo6qB:HKJSpD9+1tFGHXt+ATrKgRrqB
                                                                                                                                                                                                                          MD5:89B2B9CF5EDB18B60850D6735F6A9A88
                                                                                                                                                                                                                          SHA1:58DABFDADA4D1879D0EBD29FABB3235081D8D21F
                                                                                                                                                                                                                          SHA-256:DC88990B4A44D1E5C059CC28754C87592658081F9F8B5A19EE923B32C3DD6331
                                                                                                                                                                                                                          SHA-512:1EA683358D79ADA98F72A9CACD0C2E7121A69D8A18EA850F3EA801DD5E2F7F3488BA995F2CF17BAB41EB53658C441B06774370F8283B0EB9F3A7815A5D12D3DF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...|.U.........." .....Z...P......................................................R.....@.....................................................(...................................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19456
                                                                                                                                                                                                                          Entropy (8bit):7.171554356545069
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7eui3O7LDvGTM2tVku+pdhh2eryHU8/7X8r9ZCspE+TM4rGSIgRYBHUckAwsu4V4:7v7PvAPI70HVJeMqmHl8HQKvrfpMQ3mu
                                                                                                                                                                                                                          MD5:F64237AF9FB73E6B2204AF4A8CB3D608
                                                                                                                                                                                                                          SHA1:57AD56254F47C20F90C62C9A318EC2EB11D6EA19
                                                                                                                                                                                                                          SHA-256:E52247F3ED8045CFE5C49BC7716B21CE630C25321323D78086C428D663A32FB9
                                                                                                                                                                                                                          SHA-512:2C75B8F30D0F366C05419CC932445F7D4D8610A4286EB40486701BEAA9E2C299DBC5248DA3C56EA30816EF2CB4A02D1439B6B43A1F74C95180281875215D98EC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!......................................................... ...........@.............................................h...............h7...........................................................................................rsrc...h...........................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...............................................................................................................................................................................................................................................(...8...............P............... ...................*...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.143575750872427
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7KB60EZ8jHI7nOSeMN/KjZA8nQJ+MQ3T1:+B60EZIo5QZAnJs1
                                                                                                                                                                                                                          MD5:230F5AF6F177E15B62984B1C2295DC72
                                                                                                                                                                                                                          SHA1:AECC9D82BD086E8E97DE4197A198A5CC878BE996
                                                                                                                                                                                                                          SHA-256:8E98C8C0E80B86C333E50DD03E651A765956B67673B3BBA7A06E092232B1E979
                                                                                                                                                                                                                          SHA-512:7A2EB172DB11D65DF5CACAFC3E5054D3E9E24720BDC717E77E6632677F450EFB5CE082ECE8DBDA3E851A2E7019ADF5AD3531E526A44F0D6D2A04355557B2C6D5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0......L.....@.......................................... ...................7...........................................................................................rdata..............................@..@.rsrc........ ......................@..@...............[........d...........RSDS...H.Q.C..F...W.....C:\vmagent_new\bin\joblist\259671\out\Release\zh-CN\UDiskScanEngine.dll.pdb.........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19000
                                                                                                                                                                                                                          Entropy (8bit):7.0309842764488275
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:78PuiGyzeR3K+h1MeK6jnLDJDGPhCWNvQKvrfpMQ3B:IPCyS9K0MeKgLDJDGtQwb
                                                                                                                                                                                                                          MD5:2AB9F3047F7DE52A7FC3643F18A57161
                                                                                                                                                                                                                          SHA1:6B77196BB471309DB460FB8E28459EC06F9C7262
                                                                                                                                                                                                                          SHA-256:57D88CE3F2F234DCDB93D549201D2BA80B515F1698BF2373EEE08D38F4526236
                                                                                                                                                                                                                          SHA-512:DFE70DFCBD0881B989CDD1FD337A9A900C4A8A710548BFF5802DFF7793D3971B186E53CA6D250DFD5CC43D92FFD1944864A7EB2440081B1E7F830CA7AFD113CD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... ............@.............................................0................;...........................................................................................rsrc...0...........................@..@....................................................................8.......P.......x...................................................................................................`... .......................8.......................P.......................h.......................x...............................................................................................................................,...............8...........T...............................................8...................Z.............I.D.D._.D.L.G.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8824
                                                                                                                                                                                                                          Entropy (8bit):6.817700971019223
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7e+bsqyMrj1grjzR+vnr9ZCspE+TMArAYDi:7Rbs5M8z7eM5YDi
                                                                                                                                                                                                                          MD5:BC5C2E46AD7A64254BE2686EC39F7786
                                                                                                                                                                                                                          SHA1:DBBE1A5DA3E3D593C4428D8BAA5AD63B09844D65
                                                                                                                                                                                                                          SHA-256:E7EF1827D19F027536A5A12B2E24BBEDB4F62B8D6405A15C5DF4B6AAB592E1EB
                                                                                                                                                                                                                          SHA-512:B37ACEF04B9F988782132D69EFAA6B6BC0AE6E72F2AB1B97C886F0B67268DAFF886AC93AF5FF3486A46CA0AF8B68B4B5A6BDCAC11DCA49166FB9B7C8C34D0190
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ......wo....@..........................................................................................................................................................rsrc...............................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...............................................@...`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n.Om.hV..M.i.c.r.o.s.o.f.t. .E.d.g.e.Om.hV

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8824
                                                                                                                                                                                                                          Entropy (8bit):6.715152824341275
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:73D+Oo+hLAYCiUZ87Eg4iEz7yMhtjv1/YrxBUwTO6+vf8vkrNXZCsnlTE+TVJoAo:7T1ZatyMrj1grjzR+vnr9ZCspE+TMArc
                                                                                                                                                                                                                          MD5:B971762BE7C65DEC2EE1E3F7031BF0DB
                                                                                                                                                                                                                          SHA1:67B579094D0A47F77D5A0C17A8A47AEAECE776F4
                                                                                                                                                                                                                          SHA-256:00A833752B088536CA306527A93D582B90D88CE0AD9C0E1E8414DB0AD38BF5FA
                                                                                                                                                                                                                          SHA-512:24327C0BB3A32B7390EE772E35D7ABC4E597C1E8F9341785CB262B7A3A40525992A3CE6043F891C2C6404028CF6A3F863288A0D00768B0458ECEC70DAA89FD60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... ............@..........................................................................................................................................................................rsrc...............................@..@....................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...............................................@...`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n.Om.hV..M.i.c.r.o.s.o.f.t. .E.d.g.e.Om.hV

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):334
                                                                                                                                                                                                                          Entropy (8bit):4.131616178391176
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Q++uimVb89c0GPlpUslcip1hOQR4lo8FgEOP6wDEOPqa/9EOPqgMb:Q++ubxV0GQ6HhhR4HgEbEE9wE9gm
                                                                                                                                                                                                                          MD5:728AB1FE958BFE11D476FF3AEE19C7C5
                                                                                                                                                                                                                          SHA1:4DBA9BA8100DCB9FEC3D4549F4F1EFDC4DA4CEEB
                                                                                                                                                                                                                          SHA-256:555C7E40B7A386A161A2A65DF55040A0422BCF2589E32A3897B7D7551167CAB3
                                                                                                                                                                                                                          SHA-512:15659ACD7570426D914A03336014EA9E518FF3E8831D2E020BC39DD46726C647BF85F930BE87F9793EF1689FA03B3D011861B99C176CD25B8A4035233D37D657
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=..].nd.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=.U..v.S.u.e.N....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=..].nd.:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=..]b`.Y....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=.U..v....e.N9Y....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=..]b`.Y>f:y:.\.n.%.s.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8258
                                                                                                                                                                                                                          Entropy (8bit):3.7178922601146738
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVlktVWNjD20G4p8y2CWUbJ1J9Wc6tFWbmc:29+DgRgyCXG4p8ypWrFWT
                                                                                                                                                                                                                          MD5:B7AD245726E39501192AB9C1E31E0985
                                                                                                                                                                                                                          SHA1:1F258E39BB3ACF19EA54D942C43A1F91C446B200
                                                                                                                                                                                                                          SHA-256:E2FF76786458C111BD57D33C5656EEB9EB300CD7FEA85410576F3004D1E59F49
                                                                                                                                                                                                                          SHA-512:87E3D15209FBA5F5B5382A6C98D71DB566B94187004ACA6073CFFCF64040F884591574AF5DD2297DFFD3A8E49D4A33810932F3E5C4B3ADD90D8DE90791C94EAC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\wdi18n.sign

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):588
                                                                                                                                                                                                                          Entropy (8bit):4.8665880081214015
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:CTlx8b6wMbJi3engMVY+gTulzHtlOMHKu32J9SZou:MlW6wLsYlm+VR+
                                                                                                                                                                                                                          MD5:9B677C3A6D99801C13B7A7091179A318
                                                                                                                                                                                                                          SHA1:1B362B8BCE28D392F598CB67FAC6DFB79B3F9BB3
                                                                                                                                                                                                                          SHA-256:AF9144F854B0747275149A5FD11BC51D747DC4469BBED21FA7692A4A6D1F9A5F
                                                                                                                                                                                                                          SHA-512:1F7EEF8A19603379E021DC0FB02188134BC3DB29F07FC13B7B19848925DB4C8EEADA0AA1655D6F2DBED67867E9DC0CBD37B2F25C57CDB30C49D3CE864C5F74D5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...0...0...1.0.0.1.................................................................................................................w.d.i.1.8.n...s.i.g.n................................................................................................................~.L....!j.N....'..M..........&.z......44...M.s......]...m..ILtW^m......e...c..X..F.$0.....<.f....<...t...].5..n*.......w....$... .S................. .S.................A@.....`.......?..?.+.E.@%P.*........>....s..s.....)......;..L.....;....%.w.N.7.._..4.W...>.....j..u.c..3.D.:..u]....W\

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3060
                                                                                                                                                                                                                          Entropy (8bit):3.341662466512186
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsZg6PCabR:r5u5/+mMks5qTp1mNqce9Ooa6aabR
                                                                                                                                                                                                                          MD5:A78B3273B8CAD0CDA7B1D327EE3FBF4B
                                                                                                                                                                                                                          SHA1:E5B0A2367FD046C18580803E3397C4ADBDED7F42
                                                                                                                                                                                                                          SHA-256:F3FB6AEDE226A9773C0B8349E7548FECEDBE64EB316E69ABC78B2B0976224C65
                                                                                                                                                                                                                          SHA-512:A0F51CECB2FABD1176138FB5F29A3A667CC905B61B55427B6E1E3E1801FB8B25E5330F00C48CA24BF60C68699BE6FD97ACC72DC39FA3BF0D794DF256AC767773
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-CN\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10056
                                                                                                                                                                                                                          Entropy (8bit):6.888661965639098
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7x80+LZ4oZyMrj6Pu7CrjzR+vnr9ZCspE+TMorlY:7x8zLZJIMCPHz7eMh
                                                                                                                                                                                                                          MD5:37A82AF097F424199884182D0096C325
                                                                                                                                                                                                                          SHA1:40D2ECBFBCF483DAF1ACEA1503D0E19DCA1FED3C
                                                                                                                                                                                                                          SHA-256:09E74C26846485D2305742CD25BC480E45969F7E58276DC6F7AD37C1B1E3C353
                                                                                                                                                                                                                          SHA-512:50553455CAC09581C7F7FFDD13004A1041DA4696164B9FDDF11E585A0AA27900CDE0710BC2488BCEAACCA9CB211EBFBFE11603FBCB5E068133BB59B47B83DB44
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......S...........!......................................................... ............@.............................................p............................................................................................................rsrc...p...........................@..@....................................................................(.......P.......h.......................................................................................................................................................................................(.......................8...H...8...........................H...T...............x...............Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.f.o.x....].b*b .%.s. .... .%.s. .[.qSi.Q.@W]....].S.s .%.s. .... .%.s.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\AntiAdwa.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):81472
                                                                                                                                                                                                                          Entropy (8bit):6.8297661747701195
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:XmvblAch78FRoCcleEbj/JF4XKqIqqp6NZBPOtTbQ:XXFRoPljbaKqID02tTbQ
                                                                                                                                                                                                                          MD5:10740035C41A18D3DBEC7C1174DC0C33
                                                                                                                                                                                                                          SHA1:FC5CC93D3159DE6267AF5B58BF89DD9C96B8716B
                                                                                                                                                                                                                          SHA-256:9DB2C3A729C56CA6253BFFBE4C39395729A9DB9C8C81358CD388473D7E39BBBB
                                                                                                                                                                                                                          SHA-512:112BFEBC610324CFA827C1E1CC4778D8B7393A88C2BFD5BCCD3A1D4D344A7792AC7E14BA0E449D6A91DB3F0188A87719577B7E247A721BFA25B6A7E2F0B58078
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L....H.[...........!.....d..........B........................................@............@....................................(........c...............7...0...... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc....c.......d..................@..@.reloc..h....0......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\Dumpuper.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1060
                                                                                                                                                                                                                          Entropy (8bit):5.035697779209505
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q++uLjV+f0LZV9ULPRBeZxNKX7vQiWAx5exIoH:r+uLjV+f0L9ULPWRY7vQqjexzH
                                                                                                                                                                                                                          MD5:B004BCEB8EA6B6CD6576512CF1A39D39
                                                                                                                                                                                                                          SHA1:5D99216F24AE98B247A84636A89E8B557106710E
                                                                                                                                                                                                                          SHA-256:F3EBA2D8E7E6B11A1FBE4897A82B1FB69512305230A98668BEF0A4946F37EA72
                                                                                                                                                                                                                          SHA-512:4670706C9AB54BAFFF6534F116D77C0802489C312240B33E19560915AF9999BB9AF6C5FB4AE9304CA75BE97B4FD933E4A633573C58DB0858D92744D13C761585
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.=.3.6.0..[hQ[..X .-. ./...1XJT....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.1.=.(W.WL.N..z-N.Q.s.N.V./.....sS.\P}_g.0....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.T.I.T.L.E.2._.P.A.R.T.2.=..Vdkf}.`6^.O.v.N.O...b.P.m.aIk.a.0....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.=..`ck(W.O(u.v.z._.Q.s/.........P}_g.0.^.g.`...\/.........V3.6.0..}.z...Nk^.R.b.P.f._.v9e2."u.T.0...N....S.S+TOUL..z._(W...a..v..e...N.g.....NUO(u6b.v.P.N..e.0....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.D.E.S.C.2.=...`Yu.N.`.vo.a}.e._(.L.i.n.e./.S.k.y.p.e./.W.e.C.h.a.t.)....N.O.v._.zl...POUL..0....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.R.E.S.T.A.R.T._.C.H.E.C.K.=...e.._U.z._....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.A.U.T.O.S.E.N.D._.C.H.E.C.K.=..N!k.N.Q.c..(...R.N.P/...1XJT).....I.D.S._.S.T.R.I.N.G._.R.E.P.O.R.T._.D.L.G._.S.C.A.N._.R.O.B.U.S.T._.B.T.N.=..c.c...V.`.a.z._....I.D.S._.S.T.R.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\LibSDI.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):101764
                                                                                                                                                                                                                          Entropy (8bit):7.99820874819163
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1536:tzOCL10UoGnN912Ga4YvLP18QYEMP8/S1OMx2AST4vrg7ySps9oodOUuilMsIHJb:E01VoOjsT48a1Oa2AScas9niiGXJATgP
                                                                                                                                                                                                                          MD5:D14131C28CFDB3F1BC0281D3E17A2C4C
                                                                                                                                                                                                                          SHA1:4773986B6AE0E059EBCE0F99F8003F0EA4F4FD8E
                                                                                                                                                                                                                          SHA-256:CFC2718B83D42A06DD3BB1C23155DE63B512A65E851099F3D5745411D9B04A4C
                                                                                                                                                                                                                          SHA-512:DF997E36AD1C5FD05754AE8320C6EC9267E8ABE4CC4627BF6DB540262A61DA463820F295030B107ED57AF7DFDF8E290891DE4E7E9D9999B630CA9CB1642587CF
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:e.i/..A.ifu-a..0X....n...#.Y#z...(......7].._gB.e......s...u...t.`..Z~.U..1................U`..!.Z.....t.......eP.B@...4GV"WM..}~..J...^...e..y...R9J]d..C.|....uI....Q...!.......oc\...]....B.wO.....X;.}.0&L..,O..u.'y.......N!haE..m.-..:S%I.z.Y.. ...%.<..s...I,hZ'n.w.@.JH..s......p.U.<%^.M..;...\..B8......k......Ka_......M.DI).U..N .}...T.=.....N....Y..i.VT.....b..G8UW;..d.Zp.p\......~....b.4X.qb...5..3..s|m.[..m.W..w.E]Ysf..~.\..i....g..A.>`p..QQ.........o.GG...9u.e.,C..Pb].......G9Z.7...<.E..k/L. .Is>J>...7..qd.....F.:.C....3z$.q.<a...W..,0..Z......A...22..t....#..........H&.6<...i....W.....C.fw.... .Ebi.O.N..[......*......pO. ...y.f..$.N}.........e.3..(....[..>5[..s%.#.w...Dq.o7.Rn....d%...e."...d....J.(.R.T.q......hmv!.T..|2.f...f.q.....i....k..[2.g.U,&l.n...!.Z..7Sl.0{..O5qwO.^.%....I...J.j.?..f..o/!=....gD#=k._fF...y.%f.c..2.....M...Mt6.=;.jZ.7.....G.H$.......M.....q2(R.a.k.............dQ.......M.u.Domh_0[..I..w....#.b.(....~.o...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\UrlSettings.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22592
                                                                                                                                                                                                                          Entropy (8bit):6.61720409929198
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:78ktGdE7tDGtahJgI7nOSeMDt+jclA8nQJ+MQ3Zg:YktOSDGtaL/eclAnJ2g
                                                                                                                                                                                                                          MD5:C02E7E48AA1220DDE4EE603380E2EDC6
                                                                                                                                                                                                                          SHA1:B6F4D3E6251630B63E8DB325766A8C4C10AF74B1
                                                                                                                                                                                                                          SHA-256:C44A6E28BEAFFB6448250BBE99F633BDE342C49B380EA409309C70DA0BAF6AB8
                                                                                                                                                                                                                          SHA-512:C88FD2251E8760BDDF5C3261C89DC4ED9FEC48D07B33955E363976DF04F8EBB12298D464B1945C7B4476F521839464CD0FB2FEFD9C8EB58155750A8C3A57F7FB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...R;.[...........!.........................................................@......4x....@.......................................... ..(............ ...7...........................................................................................rdata..|...........................@..@.rsrc...(.... ......................@..@............R;.[........`...........RSDS:C..b..O.....C......C:\vmagent_new\bin\joblist\258920\out\Release\zh-TW\UrlSettings.dll.pdb.............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\DsRes.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75320
                                                                                                                                                                                                                          Entropy (8bit):6.811177194300055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:12kLlARh7hdRobk5CajXoK5EB51+9weq:16dRoI5CnWI09
                                                                                                                                                                                                                          MD5:75D8C648E822466EE0E6E6F188C78AB6
                                                                                                                                                                                                                          SHA1:BBF18898CC1E3F9B3C9B2760E1296A0466E6CD40
                                                                                                                                                                                                                          SHA-256:9AB652199F56149CC69886D09A1E2F1E33BA05F6616E6667BFF28CEDF8666E71
                                                                                                                                                                                                                          SHA-512:1840982F6C9FD8927F8BE75F165A00E8ADACB478F9EF773E6180A400AE392F86327CD1779EEE7D49405C81C9B0C5D665616C2213DD2DF5A211C3563D8E494086
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d..........B........................................ ............@....................................(........F...............;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc....F.......H..................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\DsRes64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):68184
                                                                                                                                                                                                                          Entropy (8bit):6.689096672108273
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:6SWFluWFrLpAEl60h7l61Ht01nPoMRorxNg/lVyskuDyZXAbmkiZLBkbdm:zWPrlAMh744nFRorx6OXAK/Bkb0
                                                                                                                                                                                                                          MD5:3C2666848B5E79C82A5E3CA6DEC035DB
                                                                                                                                                                                                                          SHA1:45717C11620B3A1576CA77491E730CF6C5364594
                                                                                                                                                                                                                          SHA-256:B945D5CF8FB361F819621A0B43A9DBDD85DE6BE9CCE80C26AE0DDEA152859C94
                                                                                                                                                                                                                          SHA-512:B21C44CCD0C296745442E871818E2B2C522E97FB29A94ED8A0AA2943BE31BA00DFD31AE303DE3CFEF84953D5546CC115AACCD03DDF0F04E50B739BB628337E2F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L.....-V...........!.....d..........B........................................ ......J.....@....................................(........G.......................... ...................................@............................................text...Dc.......d.................. ..`.rdata..<............h..............@..@.data...............................@....rsrc....G.......H..................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\cloudsec3.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):68664
                                                                                                                                                                                                                          Entropy (8bit):6.780515217040778
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:UimVVOWFbLpAEl6kh7lqFVx01qwoMRociNg++WSsku0JBPO109K0MeKgthDG/kQe:hmvblAch7rnRoNavJBPo09weug
                                                                                                                                                                                                                          MD5:877B714AB883F30AADF43EA86DE89943
                                                                                                                                                                                                                          SHA1:459CFF97A72AB0DD27CFCEC64BAAB879BD1149BC
                                                                                                                                                                                                                          SHA-256:DF499C56A0B35BF015457F654CA0707CA10EDF07751974D3A65C698193038ACF
                                                                                                                                                                                                                          SHA-512:907962AE5855B949276FAF9A3CC33CA1363E09C1E8F375A3925D3024C614B7AFB8DECC2438799524A574C67CF6BF27D5CF70B463BBD81419FD40664A795C80B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.a.>...>...>...7...'...7.......7...v....:t.=...>...w...7...?... ...?...7...?...Rich>...................PE..L......^...........!.....d...f......B.....................................................@....................................(........,...............;.......... ...................................@............................................text...Dc.......d.................. ..`.rdata..,............h..............@..@.data...............................@....rsrc....,..........................@..@.reloc..@...........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\dsconz.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):18991
                                                                                                                                                                                                                          Entropy (8bit):7.990379399070269
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:384:eAG4SpbCJBCXTXdZWpXnTApE+0hWoX5WG8BoLJdFIaT8nHnYcQaV:+bCiXTX+pDAG+0D5WDBoDFIaT8nZdV
                                                                                                                                                                                                                          MD5:A6A90122146A6378445D2870A0207C01
                                                                                                                                                                                                                          SHA1:C5B0B055ABC4F8E234EE81D23308D99DAE0D430B
                                                                                                                                                                                                                          SHA-256:95F5400A0E9E8BBD11A0615427C53F69F14A6C5AA229A2BB5DA714628AB8634F
                                                                                                                                                                                                                          SHA-512:D5B34B88DA2F1EFE1DA928E815BCF5E32E3B8350D824E02FBBEBC5EB3643F29D8883606C213005E9049123FFAD25DF3D3C0EF2E8761197AD323228E1A073CB95
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<................I..&...$...V.j........L................LLLD.hHLLLLLLRLEL.... ..{.....5lG..]jo.{[T....._.... ...B.+C.|..D^..H..R`.I[...BM....9.~.x.N31...pK...U.O..''z...w...XA...P...5X..nP..$.DdP<VdF.`d.V...&....h.y.b]7..P}...~..3..3...[c....1..s...[............j.....P.v...i.H.t......d.4.Q.V.KJ%......q....j+.3...b.i..[.....8...Sdy.....L81Dw5.9.%...9...5..!yk..H.IV...6.q.VW..G.3{&)E..{. ..v|K$.....E.gC@a...<t.....cy.4...~..r.$bH.Y...L...F..gN..O....6p..We..N...r{.9..;=.%..O..%]=..J.Y=#...//U.=>...F......G^........p.........c%.a.I#...G...8..8.or......!....o.S..6...L......1.c..CM.m...R.^.[:.@.0..6.j.v..A..#.&..+-..C...E.}./T...>...F......C..A...<^k.{Q,.2xaU...C%%U..m.....<....D....@.~.p......D...=JJ..q.G@...It...TI...?~.._._%5...L......ns.Y..k.....g..............XW7..CzZ9....ce@..M.....d...H9qB..J.%.......t...(.t.....5.i.2h).jK[.B3.\U.hW...aR.....sN.>..B.I:...n...3.U'.3.2.&......%-...dSM.,.Zx0..G7....myc....l...,.=.;d..f..l..|...!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\dsr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):60192
                                                                                                                                                                                                                          Entropy (8bit):5.519753061287912
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:VAiFDMIhnjuOE2vN0ni6fifgNPb1IWXusCxAOxUMGRzxreHRHodyb45U7fLZjyAM:vM4A6UAHRHF4aIn
                                                                                                                                                                                                                          MD5:44E957F7CA905C793B2C0EF4602390AC
                                                                                                                                                                                                                          SHA1:6057597E00ADA043A413F130B64AD6868FD7998F
                                                                                                                                                                                                                          SHA-256:39C4758B2682B047DEEF48B50F1B3700D39961C4F732E4FEC1E8853670E9B9D4
                                                                                                                                                                                                                          SHA-512:26AA36A2FB60B76D98BEB9E055BB3DDD42C30962B51D23521DB0D832C66BBA966BF93F052773EDA8A3B37C564121E6BADF01B030384B9828BC95F02411D07FD7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<....................r..................E...............yz=()e3 76,*+xgtkuge +&*!,+"xg...h}gz{HOy.**1e3 76,*+xgtkuge{HOy.$1$. 1{eHOHOHOy!$1$.!e +17<.!xgwuuutge"7*05xgtrge&(!.$76 7xgwuge&(!. 5$,7xgqqge! #.$)0 xggee6-*71.75xg.tge7$1. 3 )exegtgee#*7($1. 6xgvge" 1.*&$1,*+xgwge{HOy.- &..*6e3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u..6*07& .gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............,&7*6*#1..+1 7+ 1e.=5)*7 7.. 6.1*5..*(5*+ +16.u.6*07& gej{HOyj!$1$.!{HOHOy!$1$.!e +17<.!xgwuuuwge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.wge7$1. 3 )exegtge#*7($1. 6xgqge" 1.*&$1,*+xgtge{HOy.- &..*6e2*2sqxgtgee3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& gej{eHOy5$7$(e1<5 xg617,+"ge3$)0 xg...............)$66 6.......>u}v}sv.thru..htt!uh..quhuu.u.|tt..}s8..+61$+& .gej{HOy5$7$(e1<5 xg617,+"ge3$)0 xg.....gej{HOyj!$1$.!{HOy!$1$.!e +17<.!xgwuuuvge"7*05xgtpuuge&(!.$76 7xg}ge&(!. 5$,7xgqtge! #.$)0 xggee6-*71.75xg.vge7$1.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\dsurls.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076
                                                                                                                                                                                                                          Entropy (8bit):7.546626890620638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:GkqR+lkMu9qSmjQXK9K1h2Y539HfsLlQNSfP0vHFZquB+fcQ:iIkx/69KO6fsB9CHFZmx
                                                                                                                                                                                                                          MD5:69D457234E76BC479F8CC854CCADC21E
                                                                                                                                                                                                                          SHA1:7F129438445BB1BDE6B5489EC518CC8F6C80281B
                                                                                                                                                                                                                          SHA-256:B0355DA8317155646EBA806991C248185CB830FE5817562C50AF71D297F269EE
                                                                                                                                                                                                                          SHA-512:200DE0FFCE7294266491811C6C29C870A5BC21CDF29AA626FC7A41D24FAF1BFE054920BD8862784FEABA75BA866B8AB5FD65DF4DF1E3968F78795AB1F4AD0D23
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063|...............D.N[....d.s.u.r.l.s...d.a.t.............................................................8...|.............#.yI{...0%To.#/.=D....G .r.k...7.;......M...2..(.>..Z...#..F..z.QE#...Pi..q.l...>."...:1}"....S^.Qj.l.1-....p....G#....^K..k;G...1u..D.f.....[}M......G.k.t.1..v.M.........l...{.W.(.T.T..c...|.V....O_ .e.....ww..j..l<Hhr..`WU[.\W..W.i....km.Ks_.....*)-}..'...(.8..).1.E..I.gH....n....T..E..k.`......5/..........H....g~i..P"!...ga...~){.L.?B.YD:~.........../....3}.T..#....!.7."..kt;ng=...O.DN..|.._.7).%...I....C.S.m..}2...7.......k\.W.%9/2.......U#...&O.5{.G...o.....6....^..|F........0A$..\..R..c}[...XGu.I..L..jC1..m.L...^....."..[.@1+. .z.4&...F.r....c.?G..n...._.4.}...9.?.8y.b.._......AEfl._....%.........4[.I..G.. .............V.g..e.{.p......U...........3K3(Kp..,....J..Y_.[...Z.E.kF.3X...:i.g.x.C...Y8...P...6.D...2. ...L..h...D.....<N.K.p..)q......<.KqGy..i.;.....w..+r.%..i9.>..f-....J@...t..G...$3[..#(.Eh..a.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\deepscan\ssr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49127
                                                                                                                                                                                                                          Entropy (8bit):7.994263024559129
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:768:zfnjGRMoEvZEa9of1nCbj7MOQbMLvuTJH/W9sx8SpkunQDm:fGFIVenMj7MOVjQJH/msx8SWunQK
                                                                                                                                                                                                                          MD5:CE16E0C427BFE4637B621058E7D17122
                                                                                                                                                                                                                          SHA1:BDE78C25E80ABBA339D79095299C4719845E2AD4
                                                                                                                                                                                                                          SHA-256:06A5EB844A7ED5769653D1E59E79CC1A74DFC1722FE703B64DDBD73F41FCC97E
                                                                                                                                                                                                                          SHA-512:265940A4EEA22CBF2D2B7949AF73B773033222924BBE331A1782E67FE810AF618972BA66CA04237978F7642679743AB3B7110567122B9B5205FB4BBAE6700B12
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...................Y..0......y=........E...............=..<6...b....X.]..<....v.^.9h._.+.5...i.0..]..a..f.hh/v.(./..`. ...(...:.s....O...O..ELQW..........y..y<..z..:z|v..=.s...U=.Z...h.bn...&-.{.,.........Z.......8.....S...........:I...u...).....<...9.I.:`.2..I=.e..FI..::... ..j.........8..M.B...*.9.y.Z.U.)4.Z..z_.y.......b.....c....j........".j........"..*:<4.=.4.....J.$)+_.;)....X..o.....J$..+^{..2.....J.s..(.j...*.y.j.e...[_../....-.4.l..;....y...i.h.^...[y.X.r..Z..Q].r.........GZ.v<.}~|..:}.sz.Qn..c..O.wz.k.j....0...'.F..../.?2.94.\...'....[..c.......&.K..e.8..%...;....0,._.4...j...F....uS.I.L..:.dH..:.z.n.Y...Gz.V.$K..........+..-;9..y.N..DB...:..:...........b..JQz...Xh.................*.}...:..sI....Y]....U..s..J.e$...S.......s..NG....KQD.g......Q.h.l.4..mM.._..s.....g..G.v.........X..I....1...\.0.......*3....{.<.....f.$rrk..+..s.{....0....WU.w....3.6.a.....H..k...:A..vW.....6.!..-......[.9H..L....@^.p..N.E...*....2.3.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\360netd.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):44548
                                                                                                                                                                                                                          Entropy (8bit):7.721148222591724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:xW0IjxiegKAqfTtW7mYcQhirhlimzWk+MUKfiZw+5xpVRTtST1vUX:kDjsyt6mY5hirhlbzWk+JVZXxvR5SVa
                                                                                                                                                                                                                          MD5:D89FF5C92B29C77500F96B9490EA8367
                                                                                                                                                                                                                          SHA1:08DD1A3231F2D6396BA73C2C4438390D748AC098
                                                                                                                                                                                                                          SHA-256:3B5837689B4339077ED90CFEB937D3765DDA9BC8A6371D25C640DFCEE296090A
                                                                                                                                                                                                                          SHA-512:88206A195CD3098B46EEC2C8368DDC1F90C86998D7F6A8D8EC1E57AE201BC5939B6FE6551B205647E20E9A2D144ABD68F64B75EDD721342861ACB3E12450060D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d"...-..u063.......................`.8...s.............:@k.....@$...U."..3..z.&..pV....K_..J...dz.\D~...(......~=.$l..........#}..\...`.m.M...j..T........1T..Bf.q6..F,G&.._.wB.y.=.Y.L?.Cp...Ck`........E.f......y......("..#s.6....G/...\.....la.DD....(...X..W..4....>#Pi(.E......H9....H.........................................8:..8:....@.D:..D:......D:..D:......D:..D:....@.D:..D:.....:.:.:.:......9;..9;......9;..9;......9;..9;....<..<<..<....>..<>..<....@..<@..<....CF.<CF.<.......<...<.......<...<......6=..6=......6=..6=....).6=).6=......7=..7=......7=..7=....,..=,..=.......=...=....'z.='z.=....8z.=9z.=....?z.=?z.=......=..=.....*.=.*.=.....*.=.*.=.....=...=....G..=G..=..../1.e/1.e....71.e;1.e....A1.eA1.e....1.xj5.xj....>.xj>.xj....A.xjA.xj....._5n._5n.....$.o.$.o....+X.o+X.o....KX.oKX.o....##.p##.p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......@p..@p......Tp..Tp......Zp..Zp......Zp..Zp......[p..[p....E..qE..q.....T.q.T.q....+.lq+.lq....:.lq:.lq......lq..lq

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\360netr.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1392
                                                                                                                                                                                                                          Entropy (8bit):7.85421486671758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:FF30NaCrqZ7x24YSCw1Oo+Iyx20/78vOQpqjOLMDj3RymfvhC2lbwtv4RCeMBQ8Q:FF6amq1xtT3qIGSvOoQOLMD9pZCCbwtm
                                                                                                                                                                                                                          MD5:DB5227079D3CA5B34F11649805FAAE4F
                                                                                                                                                                                                                          SHA1:DE042C40919E4AE3AC905DB6F105E1C3F352FB92
                                                                                                                                                                                                                          SHA-256:912102C07FCABE6D8A018DE20B2AD97EA5F775DCB383CD3376168B7EBF8F9238
                                                                                                                                                                                                                          SHA-512:519AB81D0C3391F88050E5D7A2E839913C45C68F26DABAD34C06C461DDB84C781BF7224E4D093462C475700E706EEF562D1210CEE3DBA00A985D8DADBF165C5C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:....L..I.....e.L..6..Bg.us...p._..ok:..&b.S.h..k....c.. n3......`^i..,.9H...[kU...7.....O..A.u..BB.ag......V.~]h\....m..C[.......0u.|7..S..T!uC.Pgy5.............).v:-[.@.l0v...5M.~X.....5.@WQ.Y...O.......j..*.._....k/G..U.3C@..`u.N.{.m......._..A...L.]..-.....sG...B^.....d.y".".D;7.I.}.6.~.8.....W$...tz}W.<Qm..H$....=3.f...SJ0....<..V.M......Y:......Cd).*.q.P.......}...oq.).:b7:.9v.e.+L.....%..i........312..)_+.t..}....%..%.y3.f...D..s....;.0Y^..!.3..b7:.9v.e.+L..........b.X1. 7.\ZI%.....S.sT........gS...{...]...NM$=~......o.H0M..RB....T..$5...gS...{...].......E.+...........I.].....@iyz...%.y3.f...D..s..P[.K=q..K..r..p.....r...f$.1i..%.y3.f...D..s......h.CF^..tI...}WC<^P.g...qb7:.9v.e.+L......O..\...JZ.G...M....h....pC.Ib=.).>..ow..q..@....V.p...r:.#?.K...].R....L.T...]"H' .TE8e.yM!T}....N^....bp.%..c..t....V.............t.5...h...2.....&.....i...[.....^.u....4.."....6|#g.`.*)..gMb8.R..~.':.7.YUx.k...;..H..O....[.....c...;..t+....m...]...[.-

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\NetDefender.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21568
                                                                                                                                                                                                                          Entropy (8bit):7.103061448243544
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7+dU3JlJrXsrbqJhqg5txS62mRxI76eR3KJ1MYfEDGPhC1ov05MQ39:4IJlJrXsrbqJhqg5txxQb9KvMhDG0oi
                                                                                                                                                                                                                          MD5:C27DED6278B84D39940DC0679B06FC8D
                                                                                                                                                                                                                          SHA1:92CA42C5111A95677DE8564F7BD29567B095C74C
                                                                                                                                                                                                                          SHA-256:32E8E4D48BFC262582243B3F9ABBD90AFB349C7B3692C6C6DCBCB7067D938669
                                                                                                                                                                                                                          SHA-512:C9001B0F05ACB194476CF6ED85D9A0F9DC35092ED3B9E1B250ABB5C67F0758F86437881292A043B6E473D961CCE763B9CF294926C1900F617F03CF8CDB4DA9BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.... ._...........!.........................................................@......+.....@.......................................... ...................7...........................................................................................rdata..|...........................@..@.rsrc........ ......................@..@............. ._........`...........RSDS.._oM..A...U......C:\vmagent_new\bin\joblist\503376\out\Release\zh-TW\NetDefender.dll.pdb.............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\Sxin.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49272
                                                                                                                                                                                                                          Entropy (8bit):6.382260441683763
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:by2lF/WFLLpAEl6Zh7laV5tQ018tY+6JWvdvSB6LSFpW:W2kLlARh7IxJWvdvSB6uG
                                                                                                                                                                                                                          MD5:07384E7799496910AEA4D3E1BD2DAEF1
                                                                                                                                                                                                                          SHA1:40BF4A8272785CF0B2B4005BC7C7EB28C4E72537
                                                                                                                                                                                                                          SHA-256:D261C799DF635D960DC16D41DB6E4A4B35FEF556CBC9806758BF9F6D52E0FEAE
                                                                                                                                                                                                                          SHA-512:233F509C68CADC93D2F3931DEA90D1556621B46584FA9B51D06C3C4769DD00AF1AA33027156E08BD53D02117E02C3A5EA7C1A1DEA273305A86D8A1FAED17C76F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...a.U...........!.....d...@......B...............................................B.....@....................................(.......,........................... ...................................@............................................text...Dc.......d.................. ..`.rdata...............h..............@..@.data...............................@....rsrc...,...........................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\Sxin64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):47736
                                                                                                                                                                                                                          Entropy (8bit):6.077497740068282
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:uXHGdBPASgYoH6dzSnq5TmtzG3TpMtaBV7s8lAKYSrtP6WB/:fASgRcSqNmtzG39MkbLAGrtye/
                                                                                                                                                                                                                          MD5:81F07820F788366D528FE17E07098130
                                                                                                                                                                                                                          SHA1:8FCDF3CBB44BBA2356ED661ECDD874D28EE34AB1
                                                                                                                                                                                                                          SHA-256:5110FB7FC13BBA143562E4A95637E9BDBA636EFD8C6522607096D70A6E1ACB81
                                                                                                                                                                                                                          SHA-512:361D8D5A3EB00EE373AB7AD2E607FAF311AEA37CFB20A3782711C7E287DDE7E69776612F60FC39F3D33D20D503975A8CBE6501D8342A9A26748631BE25B8F05E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..J.t.J.t.J.t.Cl..S.t.Cl....t.Cl..C.t.Cl..I.t.J.u...t.Cl..K.t.TF..K.t.Cl..K.t.RichJ.t.........................PE..d...S.U.........." .....Z...D......................................................e.....@.................................................h...(.......4...........................@r...............................................p...............................text...nY.......Z.................. ..`.rdata.......p... ...^..............@..@.data...x ...........~..............@....pdata..............................@..@.rsrc...4...........................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\appd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16864
                                                                                                                                                                                                                          Entropy (8bit):7.053890276545169
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:79yvFhYqgNZK6ki2cP0iwfLWaVzS+ShjmM6IGBkSkt:0vFuqul2cPfwjzS+ST6nkjt
                                                                                                                                                                                                                          MD5:18AE7B812AC659FCA10FB2758334B2E1
                                                                                                                                                                                                                          SHA1:35E3D90119A61BB62FF698A1E89072EE914836F0
                                                                                                                                                                                                                          SHA-256:03FAD121AC663D16296A102ADD1153CF4E2EAEF04DE7307FC96EB84707FBEE8A
                                                                                                                                                                                                                          SHA-512:C15DE7CC6B775897D298A716E096E4ABE95751BED087CB8638537AAB7495CECA415B948574434FD9B467EE5B4751365C8F517E1FBFA47E6D8A4F4DDCE3D005A4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@.......i....@.......................................... ..................H)...........................................................................................rdata..u...........................@..@.rsrc........ ......................@..@.............#pf........Y...........RSDS.+.....H..n..~*.....C:\vmagent_new\bin\joblist\815456\out\Release\zh-TW\appd.dll.pdb....................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\appmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32124
                                                                                                                                                                                                                          Entropy (8bit):7.986133215561669
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:lVMBqFLZ0y7c90wmuJ+9SL3DSzyXLJDlpmR7sBl:lV4qFKMcq1fSLOeXZlcRQBl
                                                                                                                                                                                                                          MD5:D87F901A7919B451F1360D13DC132E48
                                                                                                                                                                                                                          SHA1:F4E2727DBC0C554F8ADC45F7A5F5B88C7CE85879
                                                                                                                                                                                                                          SHA-256:54ED3B5619D2EBB3FCD905F34906FCB03A082A5772EFA3DC3E09BC1656E02ED1
                                                                                                                                                                                                                          SHA-512:0F801C8EBC607CBE3A2E07C73729D95ACE0372E9FBE50FB45B39D09DD497CA1C8E60DE834DD12291C99568D7176CA68DBCD1A80F585761D41C5D306D186BCE46
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5.................................................................................................................a.p.p.m.o.n...d.a.t.............................................................................................................7,7.l0.*..SO.H....VI...F.7i....&......e_P/N..z...........u:+S.u...?<.nn......\y."^G......8.M.?..~Tm...E.8+!+#...V.v.9.B.(.........#..w%..w.`...0..t.............H..0..........h....3.B...t=,..V......]\oR../..A.r*D....qxj...mz......Q.....w/.2r......5..}..V%..7 Oy7)...6M....{=(.X.PEidD....'.t..[.&u.U..DR.......M.Q^.+<.=...i-..I....J.i.,.30.c..e.8N.Q.<X?J.7.......x+#...7.{.......@.6....`O......>5........w....90..Gt..W,I.a.A..;.j.H....p#.KU....c...E..8RR.)q....|%.1R.Y.....xv...y.=]%.Zj.....7F$._r..#....9#.?f..J`l..8*m..WvW.n./]T.......[.VI.~._.o.....(..RBr..1.].OE..6..z...#.....X.....h..J.~3@.b<.x....j%=_..........]..,TA..U.C.Br..}.Y..-R...]....;.w._".....'...;..~5...!.!a84...)R....rm)&!)

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\filemgr.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17376
                                                                                                                                                                                                                          Entropy (8bit):6.93806909686081
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:759V0k+9lrNjQVp6ki2cP0iwfL2NCBMS+ShjmM6IGBkSsuU:9D0zDNjQVM2cPfwYS+ST6nkFuU
                                                                                                                                                                                                                          MD5:B8B6338F6856973EF5F68F12ED99477D
                                                                                                                                                                                                                          SHA1:6D7B1EBE093624D000809E404A19786AD7BFD4CC
                                                                                                                                                                                                                          SHA-256:7BF1650720DBEFCF9CC968B2A36F0E90591D5B1957E11DD779A5DD3164F8F5C1
                                                                                                                                                                                                                          SHA-512:30EAA1242973D016C711435AA65F499D7E9B99DA3F9B33EDF3BEA695688565E3171CDC9DCD90C51567ACCE3779F8FC04674D976DBFFF1DE4CD7215E1F83950B5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....#pf...........!.........................................................@............@.......................................... ..D...............H)...........................................................................................rdata..x...........................@..@.rsrc...D.... ......................@..@.............#pf........\...........RSDSSf...VcK..Ib8B......C:\vmagent_new\bin\joblist\815457\out\Release\zh-TW\filemgr.dll.pdb.................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\filemon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17740
                                                                                                                                                                                                                          Entropy (8bit):7.971106422259788
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:yjXZ0tFBJKbHsvWWGjrLJjEZ7yslsaOatfr/yvEdGvdz6VZAefhM8:yjWBJgBNLYGsl3OAfruEdwdmjAefh5
                                                                                                                                                                                                                          MD5:8AD93BF6123D1BBE2CDE0640E0FCEB8C
                                                                                                                                                                                                                          SHA1:B8BB7FC6EE9DDEEEE86C9E204A702AD831C2BEAD
                                                                                                                                                                                                                          SHA-256:7845104F9B97DE38093E237BA3FB9C65F5D046C5DE71B95E8B811126673D6C64
                                                                                                                                                                                                                          SHA-512:C6A066CF30D40E56B5197253CE641BF82C15F415584F0B4FAE5E14F2B380A295D088D9B5471F90C491C0F937D91292BC40FEA31BFA636B86197FE0A6A274838E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5..............................................I".................................................................f.i.l.e.m.o.n...d.a.t...........................................................................................................![..... n.....n..4...@.k..K.jH....f.<...aV<|....p.z...w.~C.. S...n?...0o.5.Z..Z....2u..].:t|.{:8..p....+...X......&..'$.V.....#..w%..w.`...0..t.@...........T..0..........h.@....?.9B..^.#.-9.zh.`..74.;!*.:.;...Z...R.X?...\..R.T.=....%.S=.......q...K.....".!.8....9:....b...b.1|.&.\A9e..+x(.!;.i.-y.G.....`.2..`...A.....l....x.0...V..t r>.:?.1..M.PHPW.*..5W0..X...].'..O..J.3(..S.h.v...oC..3G..0@..$.7x...V.o....}..YK)...a....~.$....+.J}..<.,.r.a.....wX...c.....>R..UV........%.z.Hu.N..#... )I.<`..$d......&..5c.....j..D=..n...u...'.2.&.....L.p......&.f......E5.e...N#...<...)...D~.B.-#..U.s.....-.D7C[]..u;$5.6U^.4.m>...........il..m.('...._...W....2Q.r}..X.>..a.{...p...........v>.x...P.6

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\regmon.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):33196
                                                                                                                                                                                                                          Entropy (8bit):7.987558688125342
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:QwBJ1dU/1eLCN6aZefQyTqN0cYSC5ZyTx:QIJ1dfLCpyqjYZZyTx
                                                                                                                                                                                                                          MD5:5D020D1D81EAD3165C89612DAF777166
                                                                                                                                                                                                                          SHA1:8FE73FFA0319A2C2ED4E7DB7FC2E057B067E43FB
                                                                                                                                                                                                                          SHA-256:E1B3D48FB18974DD790350B21FD9ECC54C2FE873E6BDFA1FC297F8FED4A48289
                                                                                                                                                                                                                          SHA-512:7D00C2BACAB6F8B657334588C28FADCCF742CB0916F12977FE242A3E6D92C423F7F7C362861D5F1114CC8B5D5F0B6D95496B707D108C467E9468A74248AEEC55
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................8...0...0...1.3.0.5..............................................J..................................................................r.e.g.m.o.n...d.a.t..............................................................................................................%.b...x.4.......o.>..%tCY....~k~.!..m+...tx....GN/.........>.n.f..s..E.@AzT....H..+l.C.....S/..<.eT......aa...:.\t.....#..w%..w.`...0*.<.E.......(......0*...(.....0.E.].%k....9...c....vgB.9..P....B.k...n.... ......<.M....#N....p..Z#k.....4.).....$@-w..6..N.Xn....;[....i..... ..t.......FL.D.G..*&.-.[.....`9....N/.....$.....M.-.......F..D....N...|.s......xW....-$.....P.q^J.HC.:/..4....n>..[..Gu,..6KfX.P.=...!r.....N..........;........>..!w.2.{..w.4Njy.....c.T.n.M......cQq...|...$w...[.@.Y...z.OxQ...#.].m..t.Q.....+.m...~.Hj`#.vj.j.....u'I...h.....s.v.P~Ki..o..5.8.[pw..1o.8..k....%b.M.#...9..,.M.2..H._C,...s...#....=d]..cz...<......b.-n.....q.|..!e..J..."Wo.T......R*. .

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\ipc\yhregd.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15328
                                                                                                                                                                                                                          Entropy (8bit):7.211591463302131
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7NjzOo5jgFv6ki2cP0iwfLAglw+/S+ShjmM6IGBkSb:pOo5jgFy2cPfwrr/S+ST6nk8
                                                                                                                                                                                                                          MD5:341A222837CF3ED75CB20AAA6F852309
                                                                                                                                                                                                                          SHA1:D4904F4B44AE2364D1D95EB0EDD963349081BE15
                                                                                                                                                                                                                          SHA-256:09205F52926EC794AE1D43641D875F801B6BABC48D07C15A16966AA28C189219
                                                                                                                                                                                                                          SHA-512:2233B1216D45F83C622AE5D91FA5A1CD55CAB85ECE4A38094AB755A8A804F8C1191A6E41F908264CE9934C949CFF60D41F547FA380B39F791D0C1AA4D2F5E0B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L...^frf...........!.........................................................0............@.......................................... ..x...............H)...........................................................................................rdata..w...........................@..@.rsrc...x.... ......................@..@............^frf........[...........RSDS~....N..!.-cb*....C:\vmagent_new\bin\joblist\815994\out\Release\zh-TW\yhregd.dll.pdb..................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\libaw.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007004, page size 1024, file counter 12, database pages 1058, cookie 0xa, schema 1, UTF-8, version-valid-for 12
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1083392
                                                                                                                                                                                                                          Entropy (8bit):6.8400758581591
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:WMM2r6uNypYCr23p5DR3zVujTvC7RB8B3pam6OhUH:x6ZZr23DR3zVwTKP7
                                                                                                                                                                                                                          MD5:0D1DFCF969A26E5A69D96F22FD6674D6
                                                                                                                                                                                                                          SHA1:5B258115E128D57D7C50C6D30BF0CDCA5F422F0F
                                                                                                                                                                                                                          SHA-256:6B4540A2A2AF4A6EE691988C8B23654BE496276D94D53BBBC587A3EB08737182
                                                                                                                                                                                                                          SHA-512:B76E7C3ABBDE68E4F5F9C4F32AD0C83B484906365AAD2ECE54481D5A85EF5588D2EE124D30DF26E1F9CEA5F1B30428104AF6ED25C111B4B4B9BF7819C4FE7E38
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .......".................................................................-............................................................................................................................................S...#..yindexadware_nameadware.CREATE UNIQUE INDEX [adware_name] ON [adware] ([name])M......qindexadware_idadware.CREATE UNIQUE INDEX [adware_id] ON [adware] ([id]).X........tableadwareadware.CREATE TABLE [adware] (... [id] INTEGER,... [level] tinyint DEFAULT ('0'),... [flag] tinyint DEFAULT ('0'),... [score] tinyint DEFAULT ('0'),... [name] BLOB,... [company] BLOB,... [info] BLOB,... [crc] int DEFAULT ('0'),... [ratio] int DEFAULT ('0'),... [boxtext] BLOB,... [flag_ext] tinyint DEFAULT ('0')..)..........tablesigsig.CREATE TABLE [sig] (.. [id] INTEGER PRIMARY KEY,.. [company] varchar(192) NOT NULL DEFAULT (''),.. [info] varchar(768) NOT NULL DEFAULT (''),.. [enc] int,.. [mv] BIGINT DEFAULT ('0'),.. [result_md5] int DEFAULT ('0'),.. [c

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\libdefa.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):327460
                                                                                                                                                                                                                          Entropy (8bit):7.962616750550574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:A0YRCPOEtLsgNI9vVtZeIJNb4Zj9+kbdhPW:BYRC7p9NYvVbNb4ZJ++dhPW
                                                                                                                                                                                                                          MD5:AEB5FAB98799915B7E8A7FF244545AC9
                                                                                                                                                                                                                          SHA1:49DF429015A7086B3FB6BB4A16C72531B13DB45F
                                                                                                                                                                                                                          SHA-256:19FA3CBEC353223C9E376B7E06F050CC27B3C12D255FDCB5C36342FA3FEBBEC4
                                                                                                                                                                                                                          SHA-512:2D98ED2E9C26A61EB2F1A7BEB8BD005EB4D3D0DAC297C93FAAF61928A05FB1C6343BB7A6B2C073C6520C81BEFDB51C87383EAB8E7CA49BB060B344F2CF08F4D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.$.W.......'=B.yn......6..C....H.......]...k..... ..;.Y[;f..................1.......$....Qd..TI=I...q.+.&.m..2.............L..N......,.L<.{..m..-.a..J.!.~r.N?.F@...C%@....I.......{."}....#!.ve.ue......y....E.}.l.P.\E.A...C0H.1..xL.....!.5....sh).N.S.X.p.q..<.i..7)XN.hy.0Q...R......]...q..<.i..7)XN.hy..:BrV....S.X.p.q..<.i..7)XN.hy.l..G;.$...'...).1..xL.....!.5..T..X...3..d...fU7..Cj...q..<.i..7)XN.hy..Dxu.>`......=(k,.L<.{..m..-.a..#7.w..3.B.=_.m..2..........1..rA1.n..'.Z..1..xL.....!.5..%.h.$.U..s......G.U.*\.m..2..........I..~. .7..Cj...q..<.i..7)XN.hy.9.=.yp......S..,.L<.{..m..-.a....P(..m.].Q.z..N......y....E...v.|<F.2X.V$........y....E.5._..r.sE.+P...1..xL.....!.5....]......*hg_..9j.. zw-q..<.i..7)XN.hy..gU..y...%.j.."m..2............/.=W..._.........s.L.......Z... .\~'Q.+..FkN.X...9..x..3..r.I.?..]0..2.7..Cj...q..<.i..7)XN.hy.....8v.(.......q..<.i..7)XN.hy..#.y.-.O.....Z.,.L<.{..m..-.a..J..('.......=(k,.L<.{..m..-.a..._r....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\libvi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3007009, page size 1024, file counter 253, database pages 790, cookie 0x8, schema 1, UTF-8, version-valid-for 253
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):808960
                                                                                                                                                                                                                          Entropy (8bit):5.831466809640938
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:X/nCExkRpiJhfKNJhhD5PpS1t/PUjmuisxaA8Fkf7:fCExkRgJhfKNJLhctnUjmuTaAx
                                                                                                                                                                                                                          MD5:81C109E98F419A26E0E7C5F89A32F484
                                                                                                                                                                                                                          SHA1:9414A83B2196E61BA05C9E5559A318DCEDDBF30E
                                                                                                                                                                                                                          SHA-256:1B82BB5375BFF557295B36971504F142D134213E37F80464754092B55FD0A3D5
                                                                                                                                                                                                                          SHA-512:162835B9B7BEC5BFDA01B27E8EB409DE4BEE9DF3FE41F088786F590DE3D96D4C7F50E44C2263E93AF456546D2E736A0FD0A9DCE3F44B92A5C8E286F56DEC433D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:SQLite format 3......@ .........................................................................-.!.......................o..................>......[indexdesc_iddesc.CREATE INDEX [desc_id] ON [desc] ([id]).;.......Ytabledescdesc.CREATE TABLE [desc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[threshold] int NOT NULL,.[data] varchar(384),.[arth_type] int DEFAULT ('0'),.[arth_param] varchar(192).)>......[indexicon_idicon.CREATE INDEX [icon_id] ON [icon] ([id]).W........tableiconicon.CREATE TABLE [icon] (.[id] int NOT NULL,.[md5] int NOT NULL,.[arth_type] int DEFAULT('0'),.[arth_param] varchar(192),.[bin_type] int DEFAULT ('0'),.[threshold] int NOT NULL,.[bin] BLOB(102400).)..........tablemainmain.CREATE TABLE [main] (.[id] int PRIMARY KEY,.[md5] int NOT NULL,.[type] int NOT NULL,.[name] varchar(192) NOT NULL,.[desc] varchar(192).)'...;...indexsqlite_autoindex_main_1main..............{tablecrccrc.CREATE TABLE [crc] (.[id] int NOT NULL,.[md5] int NOT NULL,.[main] bigint,.[icon] bigint,.[desc

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\360SPTool.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):28280
                                                                                                                                                                                                                          Entropy (8bit):6.20744416919468
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:75wacsultAgwBAP3Excizfbl63KXHdRUvM8z7eMg:ut4B23ESYfZHL7
                                                                                                                                                                                                                          MD5:9FB25A4CCF7C5AEAEFF5C6E555D8B36F
                                                                                                                                                                                                                          SHA1:FD6459120A8A273284105105964E4BCC2822B8CF
                                                                                                                                                                                                                          SHA-256:E871EA7DA3E95A9E7BDD1BDF7B01FA1634FD700407133B75451F9E530403AC6C
                                                                                                                                                                                                                          SHA-512:05DA0E617519702DD6F5BE2B931743D6668172026D1C71744339F26F0BE83801B052084D6DFB7F3368DBAA89CB8E933E7290B940C324ABC99D524923ECB1B43B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....Z.U...........!.........T............................................................@.......................................... ..PQ...........X...............................................................................................rdata..{...........................@..@.rsrc...PQ... ...R..................@..@.............Z.U........_...........RSDS/.R.=VKG.7q..1......D:\codebase\SafeInt_V6.2\i18n\I18N\SPTOOL\TW\Release\360SPTool.exe.pdb..............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\360SafeCamera.tpi.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1344
                                                                                                                                                                                                                          Entropy (8bit):5.300230985241607
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q++uNtAPuF9iiwKnKeKn2CvmKbvEFvKKswJne/1O84nv:r+uNtAPuF9ii/C2IzsVS12v
                                                                                                                                                                                                                          MD5:0E83D2999129B19AB8B9BCA1ED8B4C2C
                                                                                                                                                                                                                          SHA1:A00C1EB6697A0D14AE0B7E7201E5C8DCD3142784
                                                                                                                                                                                                                          SHA-256:D04697CA15344A1E70819B304F870D164DE27BAFA814F345C1B30D8C0D878F30
                                                                                                                                                                                                                          SHA-512:F3D7503E02C27E42D05B1686BD596A3F792DC3F413BD160B8884022CDF56D368861DD89CCFFE3512E2B7836774D38652D43650A81C6F4DB1C1A533FA3B5A7EA1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.T.I.T.L.E._.B.L.U.E.=..g.z._ck(WSb...}..eq__j .....I.D.S._.T.I.T.L.E._.O.R.A.N.G.E.=..j,n0R.g.S.u.z._ck(WSb...}..eq__j...^p.;.bk....I.D.S._.T.I.T.L.E._.R.E.D.=..j,n0R.g(g...z._ck(WSb...}..eq__j...^p.;.bk....I.D.S._.N.O.T.E._.B.L.U.E.=...8^.[.b.`.a.z._.S...gwPwPSb...}..eq__jwP.z.`.v...y...Y.g.N/f.`;N.R.._U.}..eq__j...^p..zsS;.bk.0....I.D.S._.N.O.T.E._.O.R.A.N.G.E.=...8^.S.u.z._Sb...}..eq__j._.gwP.z.`.v...y...^p..zsS;.bk.0.].}k^.`.f\P.N........MQ...y)m2..0....I.D.S._.N.O.T.E._.R.E.D.=...8^(g...0.u.k.S.`.a.z._Sb...}..eq__j._.gwP.z.`.v...y...^p..zsS;.bk.0.].}k^.`.f\P.N........MQ...y)m2..0....I.D.S._.I.N.F.O._.A.L.L.O.C.=.AQ1.....I.D.S._.I.N.F.O._.B.L.O.C.K.=.;.bk....I.D.S._.I.N.F.O._.R.E.M.I.N.D.=..N.Q.c......I.D.S._.I.N.F.O._.N.A.G.T.I.T.L.E.=..}..eq__j2.w.....I.D.S._.L.O.G._.O.P.E.N.C.A.M.E.R.A.=..z._Sb...}..eq__j....I.D.S._.L.O.G._.A.U.T.O.A.L.L.O.C.=...RAQ1.....I.D.S._.L.O.G._.A.L.L.O.C.E.D.=..]AQ1.....I.D.S._.L.O.G._.A.U.T.O.B.L.O.C.K.=...R;.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\360procmon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):105984
                                                                                                                                                                                                                          Entropy (8bit):5.421365466013539
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:jORhlQF+MAfKrUB0FHg/S9VCJg/KJm4F9bfKJuw8AHu4+jSUMk8mA4Y8YE8RlE3w:jOBrUC4jyUJGKzgSg+HRN5Fv
                                                                                                                                                                                                                          MD5:DCEFE51599A59C329FCB5908C0E63D91
                                                                                                                                                                                                                          SHA1:B1B937B5F2083A5C98321328D722AC9298BC75B6
                                                                                                                                                                                                                          SHA-256:4549968E8D16FCC42282FCFF27ADCB5C0F98E122D545AEDA7C9EBCADFDB1515E
                                                                                                                                                                                                                          SHA-512:205D39B7324C941A59A3D3567F97F2EDCF66F61B5EAE7D4AF1A83687D9C25282C8D17EF6054558DC74AEE58736B643CE86D4DDE50D466E3505AA202B046AD5CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!.........b.......................................................*....@.......................................... ...^...........f..h7...........................................................................................rdata..............................@..@.rsrc....^... ...`..................@..@..............2\........z...........RSDS.3.sI..M......].....E:\SourceCode\SafeInt\branches\SafeInt_V6.2\i18n\I18N\360Procmon\zh-TW\Release\360procmon.dll.pdb...................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\Safemon.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):51832
                                                                                                                                                                                                                          Entropy (8bit):6.375325978686583
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:kCG11xWF7Lp/El6Eh7lKlE01M+6JWi3+1OfV6BANP1q:xGa7l/8h7M+JWL1OfV6BANtq
                                                                                                                                                                                                                          MD5:010327DFF990DAE030F2A47A644A6E16
                                                                                                                                                                                                                          SHA1:DD6361D277660ADE5A190A889FA970328BDA817C
                                                                                                                                                                                                                          SHA-256:07244498BA0E7625BE05260EE3DB3F876861F7DA6C5FE66728FF8C83FBEE461E
                                                                                                                                                                                                                          SHA-512:6725C2DC39B95C4CAF83539C5ED6B75D049FA4CF3C97188AE7FB97B49EA482891148B4C52B0E295F7FBF43C5F0E188F0D574AE022402A20E77C393370534C41D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N..G.I.W..G.X.^..G.N....G.^.M..N.....G.G.O..P.Y.O..G.\.O..RichN..........PE..L...:.U...........!.....d...J......B...............................................R.....@.....................................(.......\........................... ...................................@............................................text...Dc.......d.................. ..`.rdata..L............h..............@..@.data...............................@....rsrc...\...........................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\Safemon64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):50808
                                                                                                                                                                                                                          Entropy (8bit):6.048565843759478
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:q3v+tnPKY4PWWYzpnD9UT1tFGHXjpjqaVd/rfroLor3+1OfdF67f:5KJSpD9+1tFGHXt+ANrI1OfdM7f
                                                                                                                                                                                                                          MD5:374D69E377A8675D9EF29B1810C77334
                                                                                                                                                                                                                          SHA1:D29AB761A4D177C4EDBD20A11F031BFC43707F17
                                                                                                                                                                                                                          SHA-256:F128CAF017F5200DF11652AD6AE68A8A728A95AAB0DD12A608D9F3F5DFB191FF
                                                                                                                                                                                                                          SHA-512:AE688813AC7634368284B2B2F0D6F58D5735D15086FCBC13CB7AE3792F77220BBB7017F7608D49D42F80BFB807A4485A62EB91C23BBDE0A57B4CCF26042F875D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...3.2.#...3.5.~...3.#.3....C..9...:...q...3.<.;...$.".;...3.'.;...Rich:...........PE..d...|.U.........." .....Z...P............................................................@.....................................................(.......\...........................@r...............................................p...............................text....Y.......Z.................. ..`.rdata... ...p..."...^..............@..@.data...x ..........................@....pdata..............................@..@.rsrc...\...........................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\SelfProtectAPI2.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19456
                                                                                                                                                                                                                          Entropy (8bit):7.19526827378763
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:71LzRk8PvXUI70HVJeMRHlm7TTQKvrfpMQ35RB:ZXvXrQ1TFgTTQw7RB
                                                                                                                                                                                                                          MD5:D4A841157F48D7F44BF87C3B51C0B231
                                                                                                                                                                                                                          SHA1:CD4AF1A0A48D5DA7C52080162892884EE8570474
                                                                                                                                                                                                                          SHA-256:A8E6676960784CB0EE523BAA387D23B38F59998FCF7B2F84A9D1BB95C371D593
                                                                                                                                                                                                                          SHA-512:54CECD927EA2CA9519C36070317968959552830F512EFFC3324A43C2AA450A2475D689E75B2C1BCC397E2E22A3855EDA48120D98BCF0F6693ABBC3CEAE02B4D3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L.....2\...........!......................................................... ......S.....@.............................................................h7...........................................................................................rsrc...............................@..@....................................................................8.......P...........................................g...................................................0.......H...................`...`.......................x...............................................................................................................................................................................................................................................(...8...............<...............................T...*...........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\UDiskScanEngine.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17984
                                                                                                                                                                                                                          Entropy (8bit):7.147701139114363
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:72B60MZGRI7nOSeM16exjIA8nQJ+MQ3AW:SB60MZxZ9IAnJDW
                                                                                                                                                                                                                          MD5:14F7DA8B09F1DF7DF1CC709499FAC0BD
                                                                                                                                                                                                                          SHA1:C00BF7BAF7A937CE9D882588740073E393358779
                                                                                                                                                                                                                          SHA-256:700B40AA7F7CCA9E852F7FCF01E9F52F5D25097DEC44A20C9131C7A74FF99894
                                                                                                                                                                                                                          SHA-512:BFCE2803F64545279852DFA27E2D7E7671B630DF407DB0C836C91AECFFEA2CB867884601CDE240B7C71321AE7C61015EC04339509FF726BFB5DF0D915F624068
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......[...........!.........................................................0......Dz....@.......................................... ...................7...........................................................................................rdata..............................@..@.rsrc........ ......................@..@...............[........d...........RSDS%......M..K...XO....C:\vmagent_new\bin\joblist\259671\out\Release\zh-TW\UDiskScanEngine.dll.pdb.........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\chrome\360webshield.exe.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):19000
                                                                                                                                                                                                                          Entropy (8bit):7.020117934650466
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:7wueR3K+h1MeK6jQDGPhC3QKvrfpMQ30lYJ:0z9K0MeKgQDGUQwylA
                                                                                                                                                                                                                          MD5:A64E6D290191910DE23C6FCF242B47A3
                                                                                                                                                                                                                          SHA1:18ADF54C983CCBEDD850E8450646F6A198EFDBAB
                                                                                                                                                                                                                          SHA-256:8592FBFCAA695C0F971B69390E48577AEA47C62922D107073A0D5D75BCA5CC63
                                                                                                                                                                                                                          SHA-512:1BEA5B4669659495F5B66B462EB7DA4C73B47F7F97243683F3394B4B0C42AC5ECE48D903AEC2A2C0B7DDB2D7F9BB7FCEE74FCA2B645ED757292BDF600264282E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L....i.^...........!......................................................... ......j.....@.............................................,................;...........................................................................................rsrc...,...........................@..@....................................................................8.......P.......x...................................................................................................`... .......................8.......................P.......................h.......................x...............................................................................................................................,...............8...........T...............................................4...................Z.............I.D.D._.D.L.G.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\spsafe.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8824
                                                                                                                                                                                                                          Entropy (8bit):6.805950152070122
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7kk5UI/NcyMrj1grjzR+vnr9ZCspE+TMArDa0gJ/Q:7Z5UIVM8z7eMj0IQ
                                                                                                                                                                                                                          MD5:3E33F184FE8013844A44FB2C589C707C
                                                                                                                                                                                                                          SHA1:E47321ADD922547B0347BB3C1AC623F810FD3FFE
                                                                                                                                                                                                                          SHA-256:E426B91013F7EC7CAFA2A4018B10D8D449810B622CF519DD40CDC5B8C070F074
                                                                                                                                                                                                                          SHA-512:C0B69673CD8EB96A3E8E128D7F89535B8D2C7BE18A6779C55926B6F63AC1F4BC8812EF4B18DBD37C3F40D8E62E8FBF99EE9FA6DE1EB7B193727DC55A69CFC0C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......U...........!......................................................... ............@..........................................................................................................................................................rsrc...............................@..@....................................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...............................................D...`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n..p..hV..M.i.c.r.o.s.o.f.t. .E.d.g.e.Am..hV

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\spsafe64.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8824
                                                                                                                                                                                                                          Entropy (8bit):6.7199358075487705
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7Erm9zyMrj1grjzR+vnr9ZCspE+TMAr0UTRr:7um92M8z7eM1UTx
                                                                                                                                                                                                                          MD5:99C0D5457100B426E9B2942ED1B9B178
                                                                                                                                                                                                                          SHA1:DEE937345C22319DEBD95EC594823FB03DB8DFB4
                                                                                                                                                                                                                          SHA-256:5C808C3880D6D8F79685087619B5BB20A7543DED44505D55F94C8258DB084C44
                                                                                                                                                                                                                          SHA-512:338D5DB6215D63BBB5405DAFDFEED506D26234C362078117B1F9A13E70CD74FDBDEF6F9DCFF1891DB0C803ED0A80D2CB8029EFCB45A619AB06FC47881D9DC13F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..d......U.........." ......................................................... ............@..........................................................................................................................................................................rsrc...............................@..@....................................................0.......P.......h...........................................................`................................................................................................... .......................0.......................@.......................P...`...............................................D...`...............Z.....................S.p.s.a.f.e...h.t.t.p.:././.i.n.f.o...w.d...3.6.0...c.n./.w.a.r.n./...S.p.a.r.t.a.n..p..hV..M.i.c.r.o.s.o.f.t. .E.d.g.e.Am..hV

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\udisk.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):338
                                                                                                                                                                                                                          Entropy (8bit):4.263524886686322
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Q++uimVb89c0GPlpUss1hOQR4lo8FgEOP6KDEOPqaFecEOPqgIg5Rb:Q++ubxV0GQVhhR4HgEbKDE98E9gbd
                                                                                                                                                                                                                          MD5:22E0BAAB1C35AED7BD0C9286769921A1
                                                                                                                                                                                                                          SHA1:6B53AB47C1CE6D3A54307A422FBC8EC35024EDFB
                                                                                                                                                                                                                          SHA-256:9E5F2FF322E71374AA0174990E481AC1B8D69DA4BD3746102B31C4EB98401EAB
                                                                                                                                                                                                                          SHA-512:20A161DD77E1A483DD130673EC25453BEBB3E096051FAE4F5CFD8DD095642BBF1F0AE562855620CC3FFAABF449D0A2CDFE7CA50D42FA712FF767C85F0F72D30B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.L.o.c.a.l.e.].....I.D.S._.Y.I._.Q.I.N.G._.C.H.U.=..].nd.....I.D.S._.U.P.A.N._.K.E._.Y.I._.W.E.N._.J.I.A.N.=......x.S.u.e.N....I.D.S._.L.O.N.G._.S.T.R.I.N.G._.0.0.1.3.=..].nd.:.\.n.%.s.....I.D.S._.S.T.R.I.N.G.4.0.0.6.9.=..]b`._....I.D.S._.S.T.R.I.N.G.4.0.0.7.0.=......x.....e>Y....I.D.S._.S.T.R.I.N.G.4.0.0.7.1.=..]b`._o.:y:.\.n.%.s.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\wd.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8262
                                                                                                                                                                                                                          Entropy (8bit):3.7115360388999603
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ra9kZ7sqnvJDgTBiYK/y2lVl+AkPWKjLtapG4E8YQ7WTbJ1J9W66DFWbmc:29+DgRguDgG4E8YZWTFWT
                                                                                                                                                                                                                          MD5:E577C61B9CB751D805CAF1B71B7CAF12
                                                                                                                                                                                                                          SHA1:FDA4CBC74952F0237513ADF15DC684C36F01151A
                                                                                                                                                                                                                          SHA-256:0552112A0BDB79919BB46BEB7E133A0A109B283248206C6B5EFC77A265625845
                                                                                                                                                                                                                          SHA-512:830661B5D184E5F998F052C8080D0E9877D43A2A64F2B6F5516921B7C99499765B312C5E5075ED1F235A6DA58BE1A8D956E5BEAFAAC3BA19C69F1509D2D559BB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.1.6.9.7.5.4.0.9.....e.x.e.c._.p.r.o.t.e.c.t._.3.6.0.s.e...e.x.e.-.3...1...4...6.=.4.2.9.4.9.6.7.2.9.5.........d.e.f._.s.e.p.r.o.t.e.c.t._.s.t.a.t.u.s.=.1.....e.n.a.b.l.e._.h.o.t.f.i.x._.l.n.k.=.0.........r.a.t.i.o._.u.e.i.m.p.r.o.v.e._.a.=.3.........i.t.e.m.c.o.u.n.t.=.5.0.....d.o.w.n.c.o.u.n.t.=.3.5.....i.m.c.o.u.n.t.=.9.........e.n.a.b.l.e._.i.e.r.m.t.c.o.m.c.a.l.l.=.0.....d.i.s.a.b.l.e._.w.i.n.i.n.e.t._.d.e.t.o.u.r.=.1.....c.s.c.h.e.c.k._.u.d.f.w._.r.e.a.s.o.n.6.=.1.........e.n.a.b.l.e._.f.i.x.s.h.i.m.g.v.m.=.1.....e.n.a.b.l.e._.h.x.m.h.t.m.l.=.0.........e.n.a.b.l.e._.d.e.t.e.c.t._.s.p.o.o.f.=.0.....m.i.n.i.m.u.m._.s.p.f.t._.r.a.t.i.o.=.1.0.0.0.....e.n.a.b.l.e._.r.e.d.i.r.e.c.t.r.e.g.=.0.....d.e.t.e.c.t._.d.a.n.g.e.r.f.l.a.s.h.=.0.....r.a.t.i.o._.r.p.t.b.=.0.....r.a.t.i.o._.r.p.t.e.=.1.0.0.0.0.........s.n.s.x.s.s.p.r.o.t.e.c.t._.s.i.t.e.s.=.p.e.n.g.y.o.u...c.o.m.:.d.o.u.b.a.n...c.o.m.:.t...1.6.3...c.o.m.:.t.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\wdk.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3060
                                                                                                                                                                                                                          Entropy (8bit):3.3420973405627037
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rBPtE5/+GcfGx0uMkssYqTAMSQmGPtM4r+xcc/W9nOLsPg6PCabR:r5u5/+mMks5qTp1mNqce9OoI6aabR
                                                                                                                                                                                                                          MD5:747273074C1FE78FDB9AE9CE6F15B331
                                                                                                                                                                                                                          SHA1:6C576015DC13CA2EDEB266DBE10F693EA7772795
                                                                                                                                                                                                                          SHA-256:BEA2E3EAFF38C03C8DA0294603603312874161477678E5A2945033E49E8B1D4A
                                                                                                                                                                                                                          SHA-512:FE4C3BE6DEA314601A3F63664494EA596BFE5CAE9D1AECA87EE96046FC7D8A90243E8DBD03155EF3AEA55AE309A6C8A111F45B44967D1918F0ACAE27F5746BB6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.g.e.n.e.r.a.l.].....e.n.a.b.l.e._.s.u.p.p.o.r.t._.a.p.k.p.o.p.=.0.....o.p.e.n._.a.l.l._.r.f.u.l.=.0.....t.f.1.i.2.x.3.=.0.....s.u.p.p.o.r.t._.i.e.p.l.u.s.=.0.....t.k.i.i.c.n.k.g.e.t.=.0.....l.t.h.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.g.r.f.b.p.u.d.=.0.....s.u.p.p.o.r.t._.s.p.d.u.p.c.v.=.0.....e.n.a.b.l.e._.s.u.p.p.o.r.t._.c.h.i.l.d.d.e.s.t.o.p.=.0.....e.n.a.b.l.e._.r.e.c.o.r.d.q.n.u.m.b.e.r.=.0.....e.n.a.b.l.e._.i.f.r.a.m.e.u.r.l._.q.u.e.r.y.=.0.....s.u.p.p.o.r.t._.d.u.m.p._.g.s.e.=.0.....s.u.p.p.o.r.t._.h.p.c.c.=.0.....e.n.a.b.l.e._.w.d.f.i.x._.3.9.0.6.=.0.....e.n.a.b.l.e._.w.d.f.i.x.2._.3.9.0.6.=.0.....e.n.a.b.l.e._.c.h.s._.v.e.r.s.i.o.n.=.0.....e.n.a.b.l.e._.w.d.m.a.i.n._.a.d.f.i.l.t.e.r.=.0.....e.n.a.b.l.e._.b.h.o._.n.e.t.m.o.n.n.m.v.=.0.....e.n.a.b.l.e._.I.M.U.R.L.D.e.t.e.c.t.=.0.....e.n.a.b.l.e._.Q.R.C.D.=.0.....s.u.p.p.o.r.t._.r.i.c.h.t.a.b.=.0.....s.u.p.p.o.r.t._.s.i.t.e.c.a.r.d.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t.e.c.t.=.0.....e.n.a.b.l.e._.s.e.p.r.o.t._.a.d.=.0.....e.n.a.b.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18n\zh-TW\safemon\webprotection_firefox\plugins\nptswp.dll.locale

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10056
                                                                                                                                                                                                                          Entropy (8bit):6.886554956641785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:70C0+eCgxpyMrj6Pu7CrjzR+vnr9ZCspE+TMorPDLWH:70CzerYMCPHz7eMoD2
                                                                                                                                                                                                                          MD5:D782B07838B80666B980623CA178D375
                                                                                                                                                                                                                          SHA1:73BB48484DAC5AC2CB1E5154DB9A89728FE18029
                                                                                                                                                                                                                          SHA-256:830D3975277FDEE69979DAE592ED6C9715F7FE46FDA6B467B4408377366620C2
                                                                                                                                                                                                                          SHA-512:1BDE2E8081D08F0361BCA699E29B9EFFAC9BC36271BB0A0159D3763224736D366923F11AE0A7022B42F22A1E9F9FA4DFBB5494AF5946CB3FC13C3EA6130BE897
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o..o..o..q...n..f...n..Richo..........PE..L......S...........!......................................................... ............@.............................................p............................................................................................................rsrc...p...........................@..@....................................................................(.......P.......h.......................................................................................................................................................................................(.......................8...H...8...........................H...T...............x...............Z.....................3.6.0.w.e.b.s.h.i.e.l.d...............................................F.i.r.e.f.o.x....].e*b .%.s. ..p.. .%.s. .[.qS...}..]....]|v.s .%.s. ..p.. .%.s.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\i18ngi.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):100264
                                                                                                                                                                                                                          Entropy (8bit):6.408691887294221
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:Gn1vMwG3NaaFI27kMqAtfZzFasalDRL2HoRtr:bvNjFNlZfZbalDRL2HoRtr
                                                                                                                                                                                                                          MD5:5F8B81A374FD57B5A1C41A8D70BAF623
                                                                                                                                                                                                                          SHA1:70060C107F976BDAEC9A96E53CB0DE68203F74BB
                                                                                                                                                                                                                          SHA-256:497B04329A6005BA7F2F23EBB3FB847CCAB563FCBCB11FF383D5629357CFD5CE
                                                                                                                                                                                                                          SHA-512:38DA145E1E0FB0783BB396DBC5C210D850DC882CF71B4B2146942938A1BB7D5DAE0DEAFBD1715D98A6C7FFD9BF8BB891F965FFD04E683DF6EE5900222950411C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T......................]..7 .....7 ........y......;.......................Rich...........................PE..L...F.[X...........!................0c....................................................@.............................L...H...x....@.../...........R...5...p..P.......................................@...............|............................text............................... ..`.rdata...3.......4..................@..@.data........ ......................@....rsrc..../...@...0..................@..@.reloc..|....p.......8..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):6.8404655977582784
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:E5GyMClD74UI70HVJeMuH6MHlXLI/QKvrfpMQ3Y7:V40rQ1K6MFU/Qwq7
                                                                                                                                                                                                                          MD5:66CADF1188938F85A4325DDE3841DD72
                                                                                                                                                                                                                          SHA1:D03D9120857755EBB40D402E6B616420F7D5F105
                                                                                                                                                                                                                          SHA-256:5E5E114D90422BD815E5A35AAEBEEE9EE71E104A665B155679FEEEF276616C81
                                                                                                                                                                                                                          SHA-512:17E900F70A4A2E5D6FF8DCE760708B14D44BEA580473541DC2B57CF4480C8D8F53D78CCD3D152A71EB475293C67A8A477C0644B280AB5D614C43740328241B2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...Xm..Xm..Xm.. ...Xm..Xl..Xm.. ..Xm.. ...Xm......Xm.. ...Xm.Rich.Xm.........................PE..L....T...........!......................... ...............................`............@..........................!..,...p ..(....@..................h7...P......0 ............................................... ..,............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):166184
                                                                                                                                                                                                                          Entropy (8bit):6.909345599591555
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:AAJy0G9rT4ll9G+EkATPAeJnyiRn69yDfdCJGz9YnvUeMf:ANdAli1nPl3R6E7gGz9Ynvk
                                                                                                                                                                                                                          MD5:AE7B8E059BFCA11FEDF0EB69AC76BF39
                                                                                                                                                                                                                          SHA1:1DAF83DB9E3ED0B00917BB07D18B040946F22D18
                                                                                                                                                                                                                          SHA-256:39930B6350524454DF80245B3B4F9314C5B3C4E480E6F3A6A08A61CDB59624E2
                                                                                                                                                                                                                          SHA-512:C42FF2B7C9CD15BCADAAD93379EA49E822D8F9E935845EA1D2B2BC2126D54A1E8C5255F8E179AC499840FF8488ABC9DA125404994CB1C4BB8BA41EB827E1701F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$..........8.........m...vg.gL"<..I....^.@Q.20D..)........e.:..6.j.o..'..|sH[q.e.'.,.6KC.W..i..@G.X.>.A.+^...&.......B.!gB8...\.....>.C...a.c.......................................................................................................................................................................................................................................................v...f...f...f...g.8.f..o....f..o..f..o..f..o..f..o....f.Rich..f.........PE..L......a............................>`..............................................k.......................................P`..<....p...............>...J..........0...................................@...............$............................text...K........................... ..h.rdata...E.......F..................@..H.data...8>..........................@...PAGE....f....P...................... ..`

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker64.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):191272
                                                                                                                                                                                                                          Entropy (8bit):6.662883241672109
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:XEcVlx3NVmDYxP9ApGPVMGKraCv5ZE+ZCiygh+1XKNktV9NgeMJ:UOlx98YxP9A4dDiZJZC2ulj9N2
                                                                                                                                                                                                                          MD5:0E93F09B4E51C6A8A66CD1C9CEEB8FF3
                                                                                                                                                                                                                          SHA1:B868B7F8FD150CDD3B5D569738154E62350AEF5C
                                                                                                                                                                                                                          SHA-256:66152D1316B674A95EE0BD63844E6ACB5A709A177934814AEDE80166BF2BC204
                                                                                                                                                                                                                          SHA-512:C5B9F574D83F81B58147056F94BA82DECA63195A2454DB6F5196057E91D3E7FAC15C94951C4E7BB14D3F2AEB2A2EEC4230594646C27280ABAB58DF3F9E4EF239
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$.........................................................................................................................................................................................................................................................................................................................................................................................................b...1...1...1..o1...1...1...1..{1...1..}1...1..k1...1..a1...1..|1...1..y1...1Rich...1........................PE..d......a..........".................d........................................P..................................................................<....0...................J...@......0...................................................(............................text............................... ..h.rdata...U.......V..................@..H.data....j...p.......\..........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker64_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):199896
                                                                                                                                                                                                                          Entropy (8bit):6.728251434444443
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:pEcVlx3NVmDYxP9ApGPVMGKraCv5ZE+ZCiygh+1XKNktV97ZgeM:SOlx98YxP9A4dDiZJZC2ul797Z
                                                                                                                                                                                                                          MD5:4C253623EF3211FA2857A2CAD8B2FEBE
                                                                                                                                                                                                                          SHA1:B601B324FD09EC02E8F2722D4B9B90714F56F4DC
                                                                                                                                                                                                                          SHA-256:622DF8B4DFCE64AC7712B7BF855B2E31C6D135AC3B96568D13D0A7D07378365D
                                                                                                                                                                                                                          SHA-512:345D12F9E81FD6D4CB460933C44CC3BC5E8B2BA38FDF6FCA082103E8E0C213A1FE2A73F6E850CCDE278EB8BC531D8FD98375D6EE8EE39D7A31405FEECFDE8342
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$.........................................................................................................................................................................................................................................................................................................................................................................................................b...1...1...1..o1...1...1...1..{1...1..}1...1..k1...1..a1...1..|1...1..y1...1Rich...1........................PE..d......a..........".................d........................................P..................................................................<....0..................@l...@......0...................................................(............................text............................... ..h.rdata...U.......V..................@..H.data....j...p.......\..........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360AntiHacker_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):174808
                                                                                                                                                                                                                          Entropy (8bit):6.967824995539885
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:kAJy0G9rT4ll9G+EkATPAeJnyiRn69yDfdCJGL9unCtUeM:kNdAli1nPl3R6E7gGL9unE
                                                                                                                                                                                                                          MD5:6D58BE92029DED20769FAFBC730C2C57
                                                                                                                                                                                                                          SHA1:D182493D0DF42D310EE4E57E51A9692C16BA13CA
                                                                                                                                                                                                                          SHA-256:8CA73B8EB82F1C74152EC70A33A1F32625657A622B6C5CCD8763C91378806A8B
                                                                                                                                                                                                                          SHA-512:C8F0932425F29DD84FF9C190E1AD1117625A421EADDFE9EAA3D2B1DA233211396FE38023F0A6F5E37C76337E1754299A92C1619D79632CA605872371E8F236E7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$..........8.........m...vg.gL"<..I....^.@Q.20D..)........e.:..6.j.o..'..|sH[q.e.'.,.6KC.W..i..@G.X.>.A.+^...&.......B.!gB8...\.....>.C...a.c.......................................................................................................................................................................................................................................................v...f...f...f...g.8.f..o....f..o..f..o..f..o..f..o....f.Rich..f.........PE..L......a............................>`...............................................A......................................P`..<....p...............>..@l..........0...................................@...............$............................text...K........................... ..h.rdata...E.......F..................@..H.data...8>..........................@...PAGE....f....P...................... ..`

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):51560
                                                                                                                                                                                                                          Entropy (8bit):6.717702988312861
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:cjCu+VnfL2NOF1uTbzGwcnaIedCl5prTbb1oFx3hBi:pu+VnfLzQyaId59L1oFx3hB
                                                                                                                                                                                                                          MD5:F398C9C333589ED57BB5A99EB2D32D13
                                                                                                                                                                                                                          SHA1:1FCAC85E06506F332CAE1D29451ABE6808D8D39B
                                                                                                                                                                                                                          SHA-256:1587D34C58FF2376384A0F3B279248D080724809EAF5F251CC2DDA7896F04602
                                                                                                                                                                                                                          SHA-512:0282F9AB1084FE093E097B6C33ADFE2DE59D4ED3A9EAE12698DF7295498BA56D4E8250A130AF9F7284CD962691340246A15B3D32E9BF1DF22DDD128F44D1205C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ad.ad.ad.an9.ad....ad....ad.ae."ad....ad....ad.....ad...ad....ad....ad.Rich.ad.........PE..L......^...........!.....v...0......wl...................................................@..........................}......Tu..........X................4..........`...............................8...@...............L............................text....t.......v.................. ..`.data................z..............@....rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):224080
                                                                                                                                                                                                                          Entropy (8bit):6.694676904399179
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:ee7qtrnqJnmbEsfDBuGvb7I0KWsi7yGlyHTdO4k0Nmq65njo1C6dqwR4avmne7PA:l7KeZmYIDTb1CieGoHTdOqNiEqs4peIP
                                                                                                                                                                                                                          MD5:FEB5D9AD5A6965849756344F9947A772
                                                                                                                                                                                                                          SHA1:5E24761E4E5B7D6C116C0146DED4851DB55C8F7E
                                                                                                                                                                                                                          SHA-256:F3F3FAA4A6BA4E81271E25E99BADF4318B84637784D563A84A017C5F46CE291E
                                                                                                                                                                                                                          SHA-512:3110F5A76E5967942348BB13A669FF03C21BEB9C62405C552B530EEC8060A9B304D76F990FF8C4CECF67A4D1F66E6A32A7388A951036FA641FA98679C302B9A0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$...........@..5..i/..G.L.G.".;....4h^a.a.~.U.L....{.....O..\*....9\..#...L.;.o...l...>+.n(QN.+hr.E.J.o.|..]^b....[...'.M..s.....*..e....e........................................................................................................................................................................................................................................................Q........................................3...................Rich............PE..L.....e.............................#..............................................`........................................$..P....@...................R...P...).................................`...@............................................text....v.......x.................. ..h.rdata...7.......8...~..............@..H.data....E..........................@...INIT....D.... ... .................. ...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box64.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):349928
                                                                                                                                                                                                                          Entropy (8bit):6.245230405533177
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:FY8dYt37OfawVAGpnMmVP3YhGYyfOpcLTe4j:NI37OCNaMmV4pgKi
                                                                                                                                                                                                                          MD5:A10789A8855E0926F95163C3B7F7EAE6
                                                                                                                                                                                                                          SHA1:0D7FEA5C2A51251AFD04D88A671A034D962AD2AC
                                                                                                                                                                                                                          SHA-256:56F9A17AFACBFB83A5DB939DC111BA487F3A9523584A8295D072DAA67A709CBD
                                                                                                                                                                                                                          SHA-512:70BF098AD6B8FBB53AED6E53C8F2B6C6D22E9CC2679DCDB0CCE29DC027AA3A732E732C14BFD473BD6C49AFFF060330B4CD039F152C8FAE2D205C5ABC5586A79C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................]Xt.<6'.<6'.<6'.<7'C<6'.D.'.<6'.D.'.<6'.D.'.<6'.D.'.<6'.D.'.<6'.D.'.<6'Rich.<6'........................PE..d...3..e..........".................DC..............................................1........................................................F..<....p....... ..........PR......(...`...................................................`............................text....d.......f.................. ..h.rdata..............l..............@..H.data...............................@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box64_old.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):350984
                                                                                                                                                                                                                          Entropy (8bit):6.251752969265103
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:R5Z0MqIIHVGSTjKUSsuYRWY1fu4zcf9S4vk:t0MqII1nKUSYzG9W
                                                                                                                                                                                                                          MD5:69C04D5DA61C59C89BBD36CBAA13E9AE
                                                                                                                                                                                                                          SHA1:0369967F432D623A1FAD7C5C1A7405104FAABA44
                                                                                                                                                                                                                          SHA-256:23283E2C2BD6CCB04436C90037282DD103BC8ADD9BC62E9F5D34842E2E336B11
                                                                                                                                                                                                                          SHA-512:3BFABAD5B72EEA44AF705A3C482E7496E6A1547E0DDD429740A6D69E81895A651C87EA3CE6B53AD0AB6F2DF331516EA80BF1AE47B02D6BECB01E4D9F51AE4024
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................]Xt.<6'.<6'.<6'.<7'C<6'.D.'.<6'.D.'.<6'.D.'.<6'.D.'.<6'.D.'.<6'.D.'.<6'Rich.<6'........................PE..d...S.Ic..........".................DC..............................................EU.......................................................F..<....p....... ..........pV......$...`...................................................`............................text...#d.......f.................. ..h.rdata...............l..............@..H.data...............................@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box64_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):351208
                                                                                                                                                                                                                          Entropy (8bit):6.235738259308378
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:uZ0qbqeKCyaj6ovOTN1ZHKTiwFP3YhGYyfdzel:LeKraj6IOZ1Q+wFml
                                                                                                                                                                                                                          MD5:FCAA82754BC5FEF847524CC15140E876
                                                                                                                                                                                                                          SHA1:CA5803502D741CDA28EAD3F5B60B3DB229506848
                                                                                                                                                                                                                          SHA-256:134FD8436772D047D6ED483478CCF709C0759CB87D378661B6CDC027FB280858
                                                                                                                                                                                                                          SHA-512:D89532BD4295A8F7A21C56557B701275E3D334BA7DE601E2EB7C19700F24B8C316015548310CF044622C5D9FAF054A2E978CE890FCD789CD6D65B2E14EF5A6EE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................]Xt.<6'.<6'.<6'.<7'C<6'.D.'.<6'.D.'.<6'.D.'.<6'.D.'.<6'.D.'.<6'.D.'.<6'Rich.<6'........................PE..d...`=.f.........."..................C......................................................................................................`G..<....p....... ..........PO......(...`...................................................`............................text....j.......l.................. ..h.rdata...............r..............@..H.data...............................@...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box_old.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):221768
                                                                                                                                                                                                                          Entropy (8bit):6.687958558260932
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:+BfFCMIjeOKdZ1dTwwdLmmfXo7gGEsW39rB:+BfFdKepdrbKP7Xy9rB
                                                                                                                                                                                                                          MD5:DF38750F3F3E205E8795724D970189EA
                                                                                                                                                                                                                          SHA1:442952863DB2E6466EC9CA116B1CE85876100A89
                                                                                                                                                                                                                          SHA-256:5D90F8287AD1CCBC6E6C3C656B1A84467C50801590D8F730C10B0D106532294C
                                                                                                                                                                                                                          SHA-512:9311928C6193F11BA3778B546E0081062998B9DA4356529A341971CB343AF0ADEAEF8E4099ADCF4DC8905B68DBE8CF86D43CBB2690D64D328C21631803540B4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........... .=.;......P......G.`....=n...!..j6.......:..N!..p-`-0%.....Z\%<..J.....8.s...L.!.!...P[._.['B.K.i..Z.p}.2.y.9^.x........Jy`4m......................................................................................................................................................................................................................................................q..5...5...5...5.......<...2...<...1...<.......<...4...<...4...Rich5...........................PE..L....Jy`.............................#.......................................................................................$..P....@...................M...P..L)................................. ...@............................................text....s.......t.................. ..h.rdata...7.......8...z..............@..H.data....D..........................@...INIT....D.... ... ......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Box_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):224080
                                                                                                                                                                                                                          Entropy (8bit):6.694676904399179
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:ee7qtrnqJnmbEsfDBuGvb7I0KWsi7yGlyHTdO4k0Nmq65njo1C6dqwR4avmne7PA:l7KeZmYIDTb1CieGoHTdOqNiEqs4peIP
                                                                                                                                                                                                                          MD5:FEB5D9AD5A6965849756344F9947A772
                                                                                                                                                                                                                          SHA1:5E24761E4E5B7D6C116C0146DED4851DB55C8F7E
                                                                                                                                                                                                                          SHA-256:F3F3FAA4A6BA4E81271E25E99BADF4318B84637784D563A84A017C5F46CE291E
                                                                                                                                                                                                                          SHA-512:3110F5A76E5967942348BB13A669FF03C21BEB9C62405C552B530EEC8060A9B304D76F990FF8C4CECF67A4D1F66E6A32A7388A951036FA641FA98679C302B9A0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$...........@..5..i/..G.L.G.".;....4h^a.a.~.U.L....{.....O..\*....9\..#...L.;.o...l...>+.n(QN.+hr.E.J.o.|..]^b....[...'.M..s.....*..e....e........................................................................................................................................................................................................................................................Q........................................3...................Rich............PE..L.....e.............................#..............................................`........................................$..P....@...................R...P...).................................`...@............................................text....v.......x.................. ..h.rdata...7.......8...~..............@..H.data....E..........................@...INIT....D.... ... .................. ...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Camera.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):43952
                                                                                                                                                                                                                          Entropy (8bit):6.828477172176877
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:ZOEOVxhmxCxmeE57Ej+tM1EuZwtK784XnTdgi1hE0989WvVo/BClcNI70HVqUHeS:oVxhRsvI1En4Tz8YVoZ4Q1LLA3+ou
                                                                                                                                                                                                                          MD5:ABFE625AB51EA7EA4EC69E555CB52BF3
                                                                                                                                                                                                                          SHA1:7D44B348F7FF05B60F6A7FEEED6461EBE01C2C45
                                                                                                                                                                                                                          SHA-256:E4ED7BEA026F0E0F4CADA4CF44EA711B9BC9220B807405549C4867722ED06596
                                                                                                                                                                                                                          SHA-512:642B192D54E86C079FC3E4AAB1248815822E5001CAEECF08B28DBC1D2B0758D093A84A89E352986003B6595203960F7B7B40302DD770CCBB341EB6A6122A5015
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$...........Y...F.Wc.c8.O.....z9@..Q.e.`..!.+....Xff#1%.%...}...pU......P..N.....l.I...V.:..n..3z.K...?&.(..E.e.>J]...:..3._.&..Va..|u....^P.......................................................................................................................................................................................................................................................k.../{../{../{../{...{..&...*{..&...,{..&...%{..&....{..&....{..Rich/{..........PE..L...R..^.................N..........>........`......................................)7......................................P...<.......h............h...C...........a...............................a..@............`...............................text....E.......F.................. ..h.rdata..$....`.......L..............@..H.data........p.......R..............@...INIT.................T.............. ...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Camera64.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):49584
                                                                                                                                                                                                                          Entropy (8bit):6.627811272681834
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:hIeQ+aATLgCbIO5y/ULSUpT/r/dBBZyP1qYMUCM5aaU7AAQ1QA3BToWu:hE+aAHUENP5Ry/iAx1f33u
                                                                                                                                                                                                                          MD5:D85DAC07F93D74F073729B89DC339251
                                                                                                                                                                                                                          SHA1:E628F85F1365D9164140391CB93A2B22A4FB8BA4
                                                                                                                                                                                                                          SHA-256:5B64447141FFE714F04A4AE489DAC020B5CA0C31011C8EDCC22DA8CBFE265256
                                                                                                                                                                                                                          SHA-512:896AEEE641E5AD5DF74C16AE8BED9C0F9EF53034C391B47E5C99540A3DA58BBAE9524F0BCEBFA93F395B7B6E6A0AD1100E27F19D05C796ABB1DA6660A3B35DA2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.........................................................................................................................................................................................................................................................................................................................................................................................................C...-...-...-...,...-.....-.....-.....-.....-.....-.....-.Rich..-.........PE..d...r..^.........."......b..........d................................................)..........................................................(.......p............~...C...........q...............................................p...............................text....X.......Z.................. ..h.rdata.......p.......`..............@..H.data...`............h..............@....pdata..........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Camera64_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):58200
                                                                                                                                                                                                                          Entropy (8bit):6.802378250385203
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:wIeQ+aATLgCbIO5y/ULSUpT/r/dBBZyP1qYMUCM5aaU7AKQ1YHL/HnQA3BToWO:wE+aAHUENP5Ry/iA71OjHf33O
                                                                                                                                                                                                                          MD5:BCC43BE6E1C970AAE8DBD3D807CAE522
                                                                                                                                                                                                                          SHA1:88C0C1249189C4CAD5C556C66E6F31B1FFC9D5A1
                                                                                                                                                                                                                          SHA-256:B004E8E86E2FDF24A94237D9BDB42DA1BCBFE3AEECCE927C4EF2604A704758F7
                                                                                                                                                                                                                          SHA-512:E2E2A55CB405B17E2ECEA5EB7258D10F243927D4DEEC96CC0E3F85F5CF249CFC8411BD4478F72EEB56809FC74401D0BC625D63836BC3EF7257952E3055A71586
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.........................................................................................................................................................................................................................................................................................................................................................................................................C...-...-...-...,...-.....-.....-.....-.....-.....-.....-.Rich..-.........PE..d...r..^.........."......b..........d...............................................q...........................................................(.......p............~...d...........q...............................................p...............................text....X.......Z.................. ..h.rdata.......p.......`..............@..H.data...`............h..............@....pdata..........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360Camera_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):52576
                                                                                                                                                                                                                          Entropy (8bit):6.972400112673379
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:qOEOVxhmxCxmeE57Ej+tM1EuZwtK784XnTdgi1hE0989WvVo/BClKNI70HVqUHeb:DVxhRsvI1En4Tz8YVoZOQ1dHmA3+oO
                                                                                                                                                                                                                          MD5:7D7B0B2A0DFFAB06CD96C254B3886011
                                                                                                                                                                                                                          SHA1:2CE9F45546F032798F5D602CD4A76A3952A4295A
                                                                                                                                                                                                                          SHA-256:57A54A995B483027E06F552D27587008DFF04EFEFE14FD98DAAB057512187F46
                                                                                                                                                                                                                          SHA-512:436D4C3948327631C02250A627826F08FF32C75A5370FF7750299EB4367BA1E8292A992C6418F7E27B398D9F5FC9E76E7B88C0281DDE23EA33E87502FFFB58A5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$...........Y...F.Wc.c8.O.....z9@..Q.e.`..!.+....Xff#1%.%...}...pU......P..N.....l.I...V.:..n..3z.K...?&.(..E.e.>J]...:..3._.&..Va..|u....^P.......................................................................................................................................................................................................................................................k.../{../{../{../{...{..&...*{..&...,{..&...%{..&....{..&....{..Rich/{..........PE..L...R..^.................N..........>........`..............................................................................P...<.......h............h...d...........a...............................a..@............`...............................text....E.......F.................. ..h.rdata..$....`.......L..............@..H.data........p.......R..............@...INIT.................T.............. ...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360boxld.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):297952
                                                                                                                                                                                                                          Entropy (8bit):6.703233339703826
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Xgu6rh8ntL7ejsKRIA+546lPfYwJQ/iAW98:x6rh8ntWjsKRtx0flkiAW98
                                                                                                                                                                                                                          MD5:5A24234AA21B0F6B2A6F20B278ADBFC2
                                                                                                                                                                                                                          SHA1:4CD60D8C0A442437F9669551BC77506A67FE85B6
                                                                                                                                                                                                                          SHA-256:C842C312A0D13835EFFC9A84E2D7BA0AE857D3B6E3C56F4611A433707D504A54
                                                                                                                                                                                                                          SHA-512:410AB834ECD8409A9EA25E7230CD9ED0795FCE82E5CFDC610F18D1CE0699E06EFD0B2152FBAA2DA1F8B3982CEB95031FA19AE8953F90A59BB78F28B7958AF755
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P...(,..P...(:..P...(0..P.....P...P..ZP.....P...(=..P....-..P...((..P..Rich.P..........PE..L...V.ya.................B..........q........`....@..................................h....@..........................................0..8>...........L..H?...p..t ...b.................................@............`..x............................text....A.......B.................. ..`.rdata..\{...`...|...F..............@..@.data...@J.......&..................@....rsrc...8>...0...@..................@..@.reloc...!...p..."...(..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360boxld64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):367072
                                                                                                                                                                                                                          Entropy (8bit):6.428478914624962
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:RN9XlrU9y5rhHTl8LtawYkUjaP0Q1aOcS/6Kd/V9pe:RNZdXrH5HkUjaPM8V9M
                                                                                                                                                                                                                          MD5:73FDD2D0F52B02D85B39EFD8FDD9CA25
                                                                                                                                                                                                                          SHA1:C231A5B6FFE52CE2E1C4A972C704CC4EC7AC40C9
                                                                                                                                                                                                                          SHA-256:9CF9A98657671C653566FA16A9A70785F535E78343FC987B53EC3C1C17790354
                                                                                                                                                                                                                          SHA-512:7D464A7C381DF42C8CBC4DAE06A664AB07837C0E85C6A53C7AA4CC2C2909D43C77F0D3E5D242AC0C18F13CB43F69628367560664BB6CF8B5F32E8937491F9914
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H...H...H...A.z.1...A.p.E...A.l.C...oE..]...H......oE..J...A.}.s...V.m.I...A.h.I...RichH...........................PE..d...^.ya..........".................,[.........@.....................................K....@.................................................p........p..x=...0...4...Z..H?......$.......................................................P............................text...r........................... ..`.rdata..............................@..@.data....b.......8..................@....pdata...4...0...6..................@..@.rsrc...x=...p...>..................@..@.reloc..N............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360boxmain.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):945632
                                                                                                                                                                                                                          Entropy (8bit):6.564787394760286
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:gIaLswXCEKCQDqu+Q67w8P4B2NoCplBC6fFLEbq8eH1RtI7ZU3rJqn6rQyaUJQ5H:K62k8wwE6fibNsRq7Z+rJ+6r9a/5D9x
                                                                                                                                                                                                                          MD5:209EE3F2B59730BA6E1413C3E0C6EE09
                                                                                                                                                                                                                          SHA1:DE702E0F1571FDC0E9C31DD289572C6D5FD688AD
                                                                                                                                                                                                                          SHA-256:0352B4B7908255B9487E3581A521152B7A0AB62E428F13186D23BF41C3E3941F
                                                                                                                                                                                                                          SHA-512:9EE6D26909D620D4776355D5F6390A79B0420EBE5263322C294047B628410D8338407768CED6F6CDD0B7B38CA890F3C6315C3D659FDD8975A0CC3F0A279FF854
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W.............A..................................y..........A.......A..........8...........................Rich............................PE..L...R..a.................\...........E.......p....@.......................................@.................................<[..|....@..\...............H?...........{..................................@............p...............................text...L[.......\.................. ..`.rdata.......p.......`..............@..@.data...D........L...x..............@....rsrc...\....@......................@..@.reloc..............n..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:very short file (no magic)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1
                                                                                                                                                                                                                          Entropy (8bit):0.0
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:k:k
                                                                                                                                                                                                                          MD5:55A54008AD1BA589AA210D2629C1DF41
                                                                                                                                                                                                                          SHA1:BF8B4530D8D246DD74AC53A13471BBA17941DFF7
                                                                                                                                                                                                                          SHA-256:4BF5122F344554C53BDE2EBB8CD2B7E3D1600AD631C385A5D7CCE23C7785459A
                                                                                                                                                                                                                          SHA-512:7B54B66836C1FBDD13D2441D9E1434DC62CA677FB68F5FE66A464BAADECDBD00576F8D6B5AC3BCC80844B7D50B1CC6603444BBE7CFCF8FC0AA1EE3C636D9E339
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24488
                                                                                                                                                                                                                          Entropy (8bit):6.776347878211835
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:owfAc9ruFLJzyfGU6DXnYPLvReeMRksoPjH3RKnhU:Cd9yf++Uooq
                                                                                                                                                                                                                          MD5:E540BC23B3F5934DEE4D7B7B39FC3AC2
                                                                                                                                                                                                                          SHA1:465F0B0E4FE49B81A43980DD0CF40E068E98ABED
                                                                                                                                                                                                                          SHA-256:E794C636A50B5F51E0BD233C59C9144277A94792D3537460123A39C583D01421
                                                                                                                                                                                                                          SHA-512:39412DDEA1F7B16AE1B6D89DB7F7C24B92B1B310F3D9191AB82BFA01283044D3C4E991A5FD4EFEE98D00C1E65D76328BD396138E5DFC90F44ED49ED605F8E764
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..8n..kn..kn..k..kj..kg.Lkh..kg.]kc..kn..k(..kg.Jkm..kg.Kko..kg.ZkS..kI..ko..kg.Mko..kg.Hko..kRichn..k........PE..L...4(-X...........!.........................0...............................`............@.........................P#....... ..P....@..P............*...5...P..0...................................@...@...............h............................text............................... ..`.data...`....0......................@....rsrc...P....@......................@..@.reloc.......P.......$..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm64.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):339792
                                                                                                                                                                                                                          Entropy (8bit):6.24302089168248
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:LW5PXePt2rYuzV+Bu6Te2+YhRohOsp3Kc:C5POPYoB1Te/
                                                                                                                                                                                                                          MD5:37EF2AD85BCA66CF21AF216AB4E35707
                                                                                                                                                                                                                          SHA1:1569CB84354ED47F97844833807ED5A07DC5DF92
                                                                                                                                                                                                                          SHA-256:77FAAF6C67AB95DB1615275410D2DD611208FCE0E80771BD009CF0F8F98CF74E
                                                                                                                                                                                                                          SHA-512:E2B85223B86B8C339A2794F3E30F601C877107C5A7555EA33C173E6A79C3626A623283249D8A62FB405FDFD54EC4EBC802977D74533D8FE3EF41FD97D231B035
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................]yF.<...<...<...<...<...D...<...D...<...D...<...D...<...D...<...D...<..Rich.<..........PE..d....MFe.........."..........8......d........................................@.......z..........................................................(........................R... ..........................................................P............................text............................... ..h.rdata...+.......,..................@..H.data...x...........................@....pdata..........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm64_old.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):338696
                                                                                                                                                                                                                          Entropy (8bit):6.245573634983926
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:p/SEJSyWXpOZJK6unrgBx4TZ2+YhRohO07K9QxMG9h:FNJSySP8H4TZPK9i
                                                                                                                                                                                                                          MD5:F93FA692AA3658422997643F51C1B7D8
                                                                                                                                                                                                                          SHA1:D00DDF850A7F937D1A75C401227A70FD80718171
                                                                                                                                                                                                                          SHA-256:3C9DA5AB28427405BF1099C1E7C3E77683C658C0C7C5FC458F606F368E7C6FC6
                                                                                                                                                                                                                          SHA-512:B30B87B49F0155F2E310730A71E39DE041B74D2AAB53215089FC61BE700854D5576C540ECA34DA774C358FD89E516204BE14519576E2946A05B1F90318659745
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................]yF.<...<...<...<...<...D...<...D...<...D...<...D...<...D...<...D...<..Rich.<..........PE..d.....*c.........."..........8......d........................................@......z...........................................................(...............$.......pV... ..........................................................P............................text.............................. ..h.rdata...+.......,..................@..H.data...X...........................@....pdata..$.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360hvm64_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):339792
                                                                                                                                                                                                                          Entropy (8bit):6.24302089168248
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:LW5PXePt2rYuzV+Bu6Te2+YhRohOsp3Kc:C5POPYoB1Te/
                                                                                                                                                                                                                          MD5:37EF2AD85BCA66CF21AF216AB4E35707
                                                                                                                                                                                                                          SHA1:1569CB84354ED47F97844833807ED5A07DC5DF92
                                                                                                                                                                                                                          SHA-256:77FAAF6C67AB95DB1615275410D2DD611208FCE0E80771BD009CF0F8F98CF74E
                                                                                                                                                                                                                          SHA-512:E2B85223B86B8C339A2794F3E30F601C877107C5A7555EA33C173E6A79C3626A623283249D8A62FB405FDFD54EC4EBC802977D74533D8FE3EF41FD97D231B035
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................]yF.<...<...<...<...<...D...<...D...<...D...<...D...<...D...<...D...<..Rich.<..........PE..d....MFe.........."..........8......d........................................@.......z..........................................................(........................R... ..........................................................P............................text............................... ..h.rdata...+.......,..................@..H.data...x...........................@....pdata..........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\360ipc.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):7.348208121506828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mkmtPq0uzpweAExe8iBtD5aokH2shK2sFzhmNKrdcKQXbiaqLJthSFJYzjhG4jek:mzqx68e8etDhkWshKD3NCrOlHA+8xk
                                                                                                                                                                                                                          MD5:EA5FDB65AC0C5623205DA135DE97BC2A
                                                                                                                                                                                                                          SHA1:9CA553AD347C29B6BF909256046DD7EE0ECDFE37
                                                                                                                                                                                                                          SHA-256:0BA4355035FB69665598886CB35359AB4B07260032BA6651A9C1FCEA2285726D
                                                                                                                                                                                                                          SHA-512:BB9123069670AC10D478BA3AED6B6587AF0F077D38CA1E2F341742EAF642A6605862D3D4DBF687EB7CB261643CF8C95BE3FBA1BFA0EE691E8E1ED17CC487B11E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...1...0...1.2.5.5...............................................r.................................................................3.6.0.i.p.c...d.a.t......................................................................................................................f.......(.^..X...w...d....&....<...w......6...l..0.).(T.....3...}..._.......l...^.P..x..k.h.*....P.\..X....#..w%..w.`...02...L.......0..#...02...0.......L.D....$ ....@.?.&.c.6.."7h.p..x.m6.\\...uB.\....^..U....~B^;.....W. H....k..._.~.O.57}..W].....(...o....wf.*.#.{0..^.`.>../....>.LxJ..[..".6.u5....R.V.......z.\S.^q...../.l...M.c..%.A......)...v-.>...L4........#..o.F!^.:PG....#a.....8{.....\.....MwQ5..........qu....y.e.....-.j)a..j`...C}GM...U.H.A[..N..g.%... pO..Lf...v...7..N\U........sO~..:...^ek...Eb....mgM..j...$Ub.{.V.....A..."<.q....D..}....]~..N.5...B._(2^.....t.w.V....R.v.(x#.?..{.W...a..S..Kh~.=Up.r.h...!.cJ.B#I.j#.J.L..:.I/...."i.>..Q.0.)....&

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\DrvUtility.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175976
                                                                                                                                                                                                                          Entropy (8bit):6.586365248795287
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:OvAuavucXGI3gRwW/pjr4n8UPWtU6Kupw1xZ+DV4/S6SF8:uavucDMNOnlq92ks5
                                                                                                                                                                                                                          MD5:BC8917F469A0E356C015AD6A31ACC134
                                                                                                                                                                                                                          SHA1:A2E0FBCFF53018ED92754065BEB0A16E35339CF3
                                                                                                                                                                                                                          SHA-256:4F798CF1E27DD355709C4EBE11A24B17EE832B4051F8952D9AE12942E0CCC5A9
                                                                                                                                                                                                                          SHA-512:F9039EA609C18174DD76F5A89B6AF4908573FE194CFAF412430C755DA0626DCE7B92F668E5CAC6B195C91F17CC4EAF4DDB963B95BC6DE7483C05436F7F4F59C8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s;p. ;p. ;p. .?. :p. 2.. .p. 2.. )p. 2.. Ip. 2.. *p. ;p. .p. 2.. )p. 2.. :p. %". :p. 2.. :p. Rich;p. ................PE..L...}D.]...........!.................................................................`....@......................... C......p4..........X............z...4...........................................#..@...............x............................text...i........................... ..`.rdata...d.......f..................@..@.data...DD...P.......2..............@....rsrc...X............J..............@..@.reloc...%.......&...R..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\FileMgr.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):585448
                                                                                                                                                                                                                          Entropy (8bit):6.573085286275877
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:cMtKyXfQ+ptQ8bu6/xmWL5at/nlasOZBbiat3hWJ0X+TsKPL7gBR92L/a6:jOoYWUncJ+43h9esMOTg
                                                                                                                                                                                                                          MD5:24F9B42F54761BA6DBF999EE3753F740
                                                                                                                                                                                                                          SHA1:FE56DEEF5C0ECFEF552B3A0FDA6C15087B807EFE
                                                                                                                                                                                                                          SHA-256:A4B2B175B597CAE0135A68C794230493B3CCB4BBA7EC55A73BE3F5BC7960F0E2
                                                                                                                                                                                                                          SHA-512:560B7C679D8A8E078E1045B90193173F9D075E29251B54184E68B187816F9695F45ED1D72466E68C7B365818091B9592CF8B16764721A6C1A89AF6CC6102E496
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t]..0<..0<..0<..sh.1<..9Dk.(<..9Dt.1<..9D}.<..9Dm.'<..0<..5=..9Dz.<..9Dl.1<...nj.1<..9Do.1<..Rich0<..........................PE..L......e...........!.................o.......................................@............@.........................0"..O...,...........................P,.......N..................................`...@............................................text............................... ..`.rdata...B.......D..................@..@.data....q...0...$..................@....rsrc................6..............@..@.reloc..4n.......p...P..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\NetDefender.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):437504
                                                                                                                                                                                                                          Entropy (8bit):6.586354273735239
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:g7kRHqtbfl8vf48H9kboOH5p36RpgsJBe/Rvk9u:/q1GINX36ZeRM9u
                                                                                                                                                                                                                          MD5:9037CC729AFD97FD6828C22D650B98E1
                                                                                                                                                                                                                          SHA1:136D3B1414CC4BA923466EFCA56AC038F736BA02
                                                                                                                                                                                                                          SHA-256:62010A1954D63EE215BC6CB38071BDA11DF70C5442877F1654B26FD0057D9DDC
                                                                                                                                                                                                                          SHA-512:AD3B27D532E33D99805C29A848C3AB8FB974E542E749800856B75467956A5095769BACB8906FE3E82B66C9312776DC3F7C4EB242A469A52B260D5185D7127DDC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c..K'.}.'.}.'.}.....#.}.....<.}.......}.."..%.}.."..<.}.'.|...}.....7.}....._.}.....&.}.9...&.}.....&.}.Rich'.}.........................PE..L...\T]`...........!.....^...L.......I.......p............................................@.........................P................P..@"...........j..hB......X5...s..............................Pa..@............p..l............................text...l\.......^.................. ..`.rdata../V...p...X...b..............@..@.data...|w.......2..................@....rsrc...@"...P...$..................@..@.reloc...V.......X..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\SXIn.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):933288
                                                                                                                                                                                                                          Entropy (8bit):6.694918366317533
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:dhT0UADzz7Y1A5sjbYzA4xszuL+dBmsr9qyhvyCsxycKEYT9H2fpXjJT:X09wOujbYzAqsSczr9P62cKTN2BXNT
                                                                                                                                                                                                                          MD5:D4CC468202E2A11F553D3FE992B2ADCC
                                                                                                                                                                                                                          SHA1:A3F864B098688925210BFB70B9F47D459C0CD7B2
                                                                                                                                                                                                                          SHA-256:9D8B2541491048CA4DF4DF6602CC496318C66BC0E6E92DFC96D9D46EDEC593FF
                                                                                                                                                                                                                          SHA-512:AD1CC5065CB74C1260D1ECAF6F5F35EE09020D4688C39295E14F071C001BE7273C1DCD09D9535A3CE83F531A04299EAF722E6E23998E54E85EB8FB69F7EDCF97
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........j...9...9...9..9...9v..9...9..9...9..9...9..9...9...9...9..9...9..9...9..9...9Rich...9........PE..L....^.W...........!.....z..........vK.......................................`......v)....@.................................$/..,.......,A...............5... ...9..P...................................@...............L............................text... x.......z.................. ..`.rdata...............~..............@..@.data...8w...P...H...<..............@....rsrc...,A.......B..................@..@.reloc...?... ...@..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\SXIn64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1087912
                                                                                                                                                                                                                          Entropy (8bit):5.8920082614613865
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:TT14qTn2tvhw2dJ0pSZ2Bt9aiiBRGtEqK:iXJ0pSZ2H9aBqK
                                                                                                                                                                                                                          MD5:22256A18EBAD8A6F8591FED0931A7755
                                                                                                                                                                                                                          SHA1:7CA423B90A67D6859075D36433BCC70C8C0CF9D0
                                                                                                                                                                                                                          SHA-256:7D18DE171A74F54C018C6A2E724062E2141C13120D3A46D15488B76A550EA05E
                                                                                                                                                                                                                          SHA-512:DCF1AD42D2645BBCD546DAB75C93118A1FD5508F5AD90A1DF2BC5F50CE8572431FDA335B77EB141A60ED50B114E8A0C7334DDE3AEABE9E4CD190AD7E53892AE0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........}...}...}.......}.....}.....}.....}...|...}.....6.}.......}.....}.....}.Rich..}.................PE..d....x.W.........." .........x......p.....................................................@..................................................8..........P........M...d...5..........`...................................................H............................text...7........................... ..`.rdata...V.......X..................@..@.data...$3...`.......B..............@....pdata...M.......N...N..............@..@.rsrc...P...........................@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\SxWrapper.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17992
                                                                                                                                                                                                                          Entropy (8bit):6.25729298305223
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:EVlzYlSqPwOxkQJcdEsf7UNGmgCh1RYPw9yMrj6Pu7RZgjl7rePuXuu+vWr9ZCsx:EVlzLBCJcVQz9hvkMCPa6j8GuZeMk5
                                                                                                                                                                                                                          MD5:59AA8B40F3122C0C7A37FAF0A63238B2
                                                                                                                                                                                                                          SHA1:DB8DD47FA4DECB65628837CFE851E0D378CF5DFE
                                                                                                                                                                                                                          SHA-256:7F37DF2064FB25D595150ED902F6B5AC32F3715948A6DBCFED548C37C690761C
                                                                                                                                                                                                                          SHA-512:EDD1B7A21EC6F719DABD44CF78D349F2FA0F2B8B6699D57BD14DE6BFDD51F5C7C0C0AF183E1D4D2B00A9AEBB4B1974587141E29009C88B3ED46B7AE4B8F4898C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............u..u..u..t..u......u......u.....u......u.....u.....u.Rich.u.........PE..d......S.........." ................L..........p.............................`......C.....@.......................................... ..6.......(....P..x....@.......&..............p...................................................p............................text............................... ..`.data........0......................@....pdata.......@......................@..@.rsrc...x....P......................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\TS.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):748
                                                                                                                                                                                                                          Entropy (8bit):5.802572870700181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:CBtlIHFY5FDVrOlag3bviyuT9OQ1zFCr2TUdPKyK:oisDxlg3jiyuT9OIzFCrGw7K
                                                                                                                                                                                                                          MD5:595821681C2964B459F90BA1C42E48DA
                                                                                                                                                                                                                          SHA1:F917875FF3EC0EECAE51110409E760BBB4279589
                                                                                                                                                                                                                          SHA-256:B766621493231BCA31316B6706BD065AC0F604E74B1273601361602FA30DCDE7
                                                                                                                                                                                                                          SHA-512:E4C827CBE8E3616758368F9E91351DFC273767E74E2611A1E1BC401A4243E4AC3AA798A7ED024E64154E957F1694A260459E924425940E9979D8017F277D4F43
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...0...0...1.0.0.3.............................................?/.:................................................................T.S...d.a.t........................................................................................................................".......'N..;.![Y.4.M.C...{.........=.s.J.......k.-..<]..U.B.m............3..l...6..f..Fu2SSE.r.H...&..K..g.bymt......|...|........7..|X...SJ.|.........v@..w.|...|......f4...>*.Z`....d.x.......6C...y<FG..a]..O.9..A......FDh..dE..y.K_.ms"\<........P...1q.TH.$.M.Mr.;w..Z.?.&N..e...%O..(.}X..$..G3......B...+..w66..}.<h8..!#@....T.`8.b...c.@B...o#*..G(.YM.%.o..9...CdO...E.\.[]....M.b....4...Y#8....Y.cD.:./.G.:.f&.Q....%..90..<.......v..}.2\.At4

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\X64For32Lib.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):61288
                                                                                                                                                                                                                          Entropy (8bit):6.681755388463443
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:/l+SR4JFfLGV6R7+d8xJGBXbT91WFIm3hX:/l+SBfaJGBXbT9YFb
                                                                                                                                                                                                                          MD5:BDCE31FC701C9AA16CA392A561BA102D
                                                                                                                                                                                                                          SHA1:58BBDEB96E7819B00D60F0E6580DFC455774A9F7
                                                                                                                                                                                                                          SHA-256:3305AD2718C9BB9BD1DB19CDE17A184E0D7E497FF3930050C74875BC50F9690B
                                                                                                                                                                                                                          SHA-512:2A16CC0A0BF718F661A3ABE8F36B87C8B13716D5BDAA4C2768840734321F879DE3D60255B67B2B858EABD627CF4302D7BE0A29648BB65BEDBFB5F838C9B96863
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*_.K1..K1..K1..3...K1..3...K1..3...K1..3...K1..K0..K1..3...K1..3...K1......K1..3...K1.Rich.K1.........................PE..L......]...........!.....t...@......."...............................................j....@.........................p...|......(........................4..........0...............................P...@............................................text...$s.......t.................. ..`.rdata...............x..............@..@.data...<...........................@....rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\appd.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1066464
                                                                                                                                                                                                                          Entropy (8bit):6.551673855474789
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:wl3fJKXVuCziALuhjm+vracAftR/18b72rp:wlkXV5z9ChqyrabftZ18b72rp
                                                                                                                                                                                                                          MD5:CC1C8CA72D9725E8D8BB2A3FF78DB5FC
                                                                                                                                                                                                                          SHA1:A03E8A1CAF3FC6F391BAED7A62FC485C331C26CF
                                                                                                                                                                                                                          SHA-256:E5E69D28A2BF04ADFBF9C6D815930F3A4DADD848B7A2E79EAA2EACBFC731D6D0
                                                                                                                                                                                                                          SHA-512:8EA0800DAC5FF1B132A22EDBB501110EDE742076783ED4D6C0AC3C6E833445410AA690BC440CF8A9380DDA1BB7AAE62D3F35BFA9BD6BC5B9FFAC9373DAC226F6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Yara Hits:
                                                                                                                                                                                                                          • Rule: JoeSecurity_PsExec, Description: Yara detected PsExec sysinternal tool, Source: C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\appd.dll, Author: Joe Security
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?bv.{...{...{.....E.y...r{..a...eQ......r{..z...r{......r{..Z...{...4...r{......r{..z...eQ..z...r{..z...Rich{...........................PE..L....Cqf...........!......................................................................@.................................l...h.......................H)......x...@...................................@............................................text...n........................... ..`.rdata..._.......`..................@..@.data............6..................@....rsrc...............................@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\appdef.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2860
                                                                                                                                                                                                                          Entropy (8bit):7.623509802543803
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:Ba4T7guR9qUcizaIBTcg9DXs6cXNUSfVaACJ+giWe3oU4AemkWqz0KF5G:BT7lR4cz5dH41X5CGLjeZle
                                                                                                                                                                                                                          MD5:622A9D33A8194B1D25134728843FDA67
                                                                                                                                                                                                                          SHA1:2F94EC2E6C4C0A1F3355019F737390AA40F0687F
                                                                                                                                                                                                                          SHA-256:A213A922E2B2520F86EE7D5F76C51B72639E7C7C42FA1DF26E01741B75DA8BB4
                                                                                                                                                                                                                          SHA-512:52ACD862BD0310CDE8644E90BFDFCE21282C72A40D6952306CB75324E99532E88F28845E6D9615ED90504069F7D3AD05C74182DF659E4A3F7899265807F95D6E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...0...1...1.2.4.1.............................................@w.................................................................a.p.p.d.e.f...d.a.t.............................................................................................................|&..!qc...>...... K.ZJ.1).!..m........i6..o..H........H|(b0....m..#......:.x.....A..$[l.1.j..K1.......mD..-%...`|~$W..U...|...|........7..|X...SJ.|.........v@..w.|...|....1._.{..SpN.v....VX\8.i..)..W.~B..`rpCB....|$./.....ie?.Z..NLw..q3.y/d...W.;.E.9/,..wV=.....e40..QV.Y.D3.M....+..}.:.......^X..\..$...wY..V...x..4J..>0(.o....F.M.K..bh. x...f..Ek...X.v.zQ.U.'.0........s....7....XN..LU1.g?^B..:c.f.5zb..m.mYx.`.(}..N%.^...H.*..o.Mt........S.l..p..B...I.s|..k.^../..P.$M.kn........1..C_. ?........jM.T.......$..>.g..2d..UzZ.....eyvFV.$..|.Uu5..E.."j+B.n.|..1. ..z..."..r....H..ih.....7.f.:.N.4...r8.............>A8+./...LZ..A......z2......>(K'.{?"n^.X ..I..b+3c8..U.-..........c......!\.4X..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\appdext.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):186952
                                                                                                                                                                                                                          Entropy (8bit):6.5056365256123945
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:912TjokE581XxtogLyMkmoWWapS5YWcvZA7n1+DeuXHW39Flpjf:6TjXEmntTWWWacRcvyUBChT
                                                                                                                                                                                                                          MD5:1976C7FC84A853A41355787923CE86CB
                                                                                                                                                                                                                          SHA1:CF8009485F909AFEEB986BD377496A09CA673301
                                                                                                                                                                                                                          SHA-256:44CC412173A88B321DE3008742FD092A45BBB7EDB65E7F25CC385908CD3DA063
                                                                                                                                                                                                                          SHA-512:F0A6431AB31A6A634E2A535C1FAA4DC614502614C72BF5D397CC1DEDF4F80CAF56D40A964F4CA224AF0B7DE841B0025D9B2AFC1E1456F0EA8EBAF93F456857D4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.|[bv..bv..bv..k...pv..k...Xv..k....v..k...sv..bv...v..k...~v..k...cv..|$..cv..k...cv..Richbv..........PE..L......[...........!................. ....................................................@..........................X......0J...........................7..........................................."..@...............|............................text............................... ..`.rdata...x.......z..................@..@.data....R...`...$...F..............@....rsrc................j..............@..@.reloc...........0...p..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\ipcService.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):707816
                                                                                                                                                                                                                          Entropy (8bit):6.671568938076842
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:NXv0t8i5fi8uZ0aN579FP6XOTpDTKOxQewo0+ozWBBBLFZ0VwzHTADo9TpWFB1i:x0tt9xOR2beBBKVwDEk9Tp2BI
                                                                                                                                                                                                                          MD5:8F0418053A0676904C441043AABE3663
                                                                                                                                                                                                                          SHA1:7DA232478AA27C1CF0C7B03ED5D8AA72834C37B9
                                                                                                                                                                                                                          SHA-256:802022C4C4801D52AE2F00BBF970AC4D01E0EDBB562BF6FCF097C587D81410AD
                                                                                                                                                                                                                          SHA-512:788BB717E7A4FC144BD44867C1E40F61EDBEE158A6ECA407007EB70A8DC6A543097BBC16BF1E7DD2EA7F676CAEAFD834780BDC73DBA3D99706BE581D30E5608F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@d..@d..@d...k.Bd..I.'.Xd..I.8.Ld..^66.Dd..I.!.ed..@d...e..I.1..d..I.6..d..I. .Ad..^6&.Ad..I.#.Ad..Rich@d..........................PE..L.....e...........!......................................................... ............@.........................@...........@....p..................P,.......k..P...............................("..@............................................text............................... ..`.rdata..@...........................@..@.data...`........6..................@....rsrc........p......................@..@.reloc.............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\kmconfig.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):312
                                                                                                                                                                                                                          Entropy (8bit):2.34717255095342
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:LMqSsiCP5678H+zxgl9sSzgzHOc6zU64g6gcIgPLg8n8Kg6gOgwlllIBIY6U:gqSDCR6WMSm6cO5zN6TIKt8KgLPFizU
                                                                                                                                                                                                                          MD5:594768E842E58F4B63243FB85F249ED1
                                                                                                                                                                                                                          SHA1:D40703A848D25EB5338E95A3EA1EF8FA644D6BC1
                                                                                                                                                                                                                          SHA-256:12C05C07737867555C5D023F678C443AAFE0E2D6A72E681537A0034BEF9483AB
                                                                                                                                                                                                                          SHA-512:291D229A103E92EFECED30C5730B978BAEC2D255A6A9E2EA40DF16132EE6AE294BB84D02405BC2537E71646D0BF5472E9E656A972C70C38197D725A72F18F0F5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:9......G......Ve.1"8...........OEEEoE.E.E.E.E.E.E.EvEwE.E.E.E.E.E.E.E.E.EkE.E.E.EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE6E$E#E E(E*E+E.E6E3E&E.E*E+E,E1E*E7EkE!E)E)EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE.+,1,$),? EEEEEEEEEE

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\qutmipc.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):170856
                                                                                                                                                                                                                          Entropy (8bit):6.55483314591404
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:4JJiNkByXIzFu3wK672soO82qUyleRR2v6eY8lMnu+wqH6F3:477yIzFfKTsS2qUKeXC5lRR
                                                                                                                                                                                                                          MD5:7EE49A57339ABCC35FCDE25D3F5EE8D9
                                                                                                                                                                                                                          SHA1:7A7F471DADD973CA57C79C43D93828B4496570E8
                                                                                                                                                                                                                          SHA-256:DC477A4B41CA92D94CB7092B458F35DEF2EF6F9A0B23A237A363E341E22AEABB
                                                                                                                                                                                                                          SHA-512:F978F6C882D80CFD87B2EF75EBB1C18C9BFB6759D28C0F503395217373AE241E5B08212D4D42373F6B94AFFBF775959E06BD1CAD5D09C488DC139906A0D4AB4B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$...`..R`..R`..Ri.]Rk..R.BRb..Ri.ARr..Ri.WR...RV..Rb..RV..Rc..Ri.GRq..R`..R...Ri.PRZ..Ri.FRa..R~.@Ra..Ri.ERa..RRich`..R........PE..L...f..]...........!................K.....................................................@.............................a............................f...4..............................................................d............................text............................... ..`.rdata...O.......P..................@..@.data....n... ...(..................@....rsrc................8..............@..@.reloc..<#.......$...@..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\qutmipc.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):74688
                                                                                                                                                                                                                          Entropy (8bit):6.63443244062354
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:xJyG/6h0njsg08zyQVp1IckfMToN13D9C:+G/6h0jDzJzCckfMT+pU
                                                                                                                                                                                                                          MD5:BFAA9FCEE08497162BB074B7573641E5
                                                                                                                                                                                                                          SHA1:1CE73394824FC62E54A2931E403E814A1CCB689E
                                                                                                                                                                                                                          SHA-256:DCB710D597A8A72686E56534AC747A888BDD46024E8E60C3C18EEA1A5757C1D8
                                                                                                                                                                                                                          SHA-512:2D202537FA830542C5FB27AE4C869E17AF4C52FD8D72FC555205E6691D56BC101D16E11AEDF97AB6192753365432349D48282C06C03A642C8DC4B945D53B59B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$...........k...^.:B...Uy..G.......P.>c\?u+/xi...!.R....@r....].t..]:..Ok..0.x._...V...8:..K....~.).>......yZ......G.Jb}..B.......DT`C.a.3\3f.......................................................................................................................................................................................................................................................NI./'../'../'..W.../'../&../'.l z../'.l x../'..W.../'..W.../'..W.../'.Rich./'.................PE..L...V.3\.....................3......>.......................................................................................P...<........................C..........................................8...@............................................text.............................. ..h.rdata..............................@..H.data...`...........................@...INIT....|...............

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\qutmipc_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):83304
                                                                                                                                                                                                                          Entropy (8bit):6.767814267015219
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:JJyG/6h0njsg08zyQVp1IckfMTK1KuQD9i:2G/6h0jDzJzCckfMTKGU
                                                                                                                                                                                                                          MD5:329762346802C2E93BB70E3762D3BDC2
                                                                                                                                                                                                                          SHA1:31A0770F9BF8982890F7EB1C7C67F24F9367E3B9
                                                                                                                                                                                                                          SHA-256:5C880A70EA8B4E3573E9B6F80AF637EE5489D438B31E9C022D73E763FCBEC5B7
                                                                                                                                                                                                                          SHA-512:3334696AE7BE495EB3BF4BF8112BF90FF6A9671A068CAAC0D530D6E143B85DCDC327252CB37D9BAE802850E91072639F62C53B75770DB30BA546B53401AE1446
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$...........k...^.:B...Uy..G.......P.>c\?u+/xi...!.R....@r....].t..]:..Ok..0.x._...V...8:..K....~.).>......yZ......G.Jb}..B.......DT`C.a.3\3f.......................................................................................................................................................................................................................................................NI./'../'../'..W.../'../&../'.l z../'.l x../'..W.../'..W.../'..W.../'.Rich./'.................PE..L...V.3\.....................3......>.......................................................................................P...<.......................Pe..........................................8...@............................................text.............................. ..h.rdata..............................@..H.data...`...........................@...INIT....|...............

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\qutmvd.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):102496
                                                                                                                                                                                                                          Entropy (8bit):6.557778827364857
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:LvHAH74ugMR7NrUCga4UkvmWKvOT2lXgODuqAo+rvnyfe0qmofvghl:LAbQkNUhajPXjDuq7+rvyfe0qVS
                                                                                                                                                                                                                          MD5:2CEFF7B131BF05F6D98318C309F225B7
                                                                                                                                                                                                                          SHA1:9A218DC20C839A7E64A82CC66ACE83AF210D4063
                                                                                                                                                                                                                          SHA-256:70F19BE3113626A79783D68F5EEBC080D376F5DF6B647FB95FB9C5D7479C4FFC
                                                                                                                                                                                                                          SHA-512:E285A1435D640A6CC457ACC32EEDA70C8E57C58E76D0A951800890D4FDDB25B32A46932A20432F536FD8C6A2AB1B9D271EBF80F2E5E424C7AB33BD7D4D6D55EB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w3\..]...]...]..n....]..n....]..n....]..n....]...\...]..n....]..n....]..D....]..n....].Rich..].........PE..L....Q.Z...........!.........p......l ..............................................p.....@..........................6...... /..(....................Z...5...........................................%..@...............X............................text............................... ..`.rdata..V7.......8..................@..@.data....K...@....... ..............@....rsrc................8..............@..@.reloc..T............>..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\signbwl.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):684
                                                                                                                                                                                                                          Entropy (8bit):5.558776017301648
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:CTl888mukDYfL8kTnSCJNBl4hr+Yypkhu+Pl:MlTifxhjBlkwpgxN
                                                                                                                                                                                                                          MD5:36BE3B220BFA586B08179546D51519D8
                                                                                                                                                                                                                          SHA1:378264409CD8DB65262CD725CA76845B18BBFE6E
                                                                                                                                                                                                                          SHA-256:BADDAFFA266D0D742F4B7A41251E518C75EB73EA0C1893EE530DFD7153AB9299
                                                                                                                                                                                                                          SHA-512:DEDEF2FB363FA1000F54351A015EBF7E55CEC6ED5C6C75E1046C88FD158F490AB4187EA46190E425F0432C993054B89D52013C7E70978E58E80056904B5AE4FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1.0.0.1.........................................................@..|................................................................s.i.g.n.b.w.l...d.a.t.............................................................................................................*1..B..T.\..Z.}9..%..M....=X@/...q..-6H...i.G.....T.2..!.l..N.....~....4.]..B..ZY.Y]...m0h.......(......G..K..Yx........ ... ......|,......|...|....y..|.<Xx..8.....:<Xx......f.....$\Q.6.N.=.<.....z..........g...-...R.g......./......d.1.9TI...lk.z.q....j.zS&.....)..(j..rl..tB-.AW5-B..gG........I.s.....B..d;O......vU.VJ..Gm....A.....p...z9...>5......E.LGh&.}.........#..hZ...u

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\ipc\yhregd.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):490728
                                                                                                                                                                                                                          Entropy (8bit):6.591777567822997
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Nh0ojMN/vzqxM7MHGeBNf58IzR/TatzGSEsPsDPGZ6YDdmf6qWcVDFM7MvU07U5B:Nh0OMFoM7aB78YfSEsPT/XLcVkMs07rs
                                                                                                                                                                                                                          MD5:59748CE1851D6059A42F8E1F1A8061D1
                                                                                                                                                                                                                          SHA1:4D264E57F2BE2687A86449E0B19E6E4995E42B1F
                                                                                                                                                                                                                          SHA-256:F0006DCCAE1BCA7D167BA484B65239FE1F3F75D5EADBD1449AC47E9610B3FC3D
                                                                                                                                                                                                                          SHA-512:F6EBFD3B9B88EF20F4BFB162419EDC28B9ADFFAF53441EB68660FE52C536E7CC0AE2D9987B9DA4B735AC3D15452F1DD2B4A6D463BDB43F275050F45D459C9D1B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......u..G1...1...1......3.......5...c..:...c..3.....X.=...............5...8.?.3....)m.&......0......?......9......,......6...c..7.......3.......*...1..........s......0.....U.0...1.=.0......0...Rich1...................PE..L....r.e...........!.................\..............................................>.....@.........................p...P............`...............P..P,......(H...\..T....................].......\..@...............d............................text...j........................... ..`.rdata...T.......V..................@..@.data....Q..........................@....rsrc........`......................@..@.reloc..(H.......J..................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\leakrepair.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):753272
                                                                                                                                                                                                                          Entropy (8bit):6.4996134716142
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:xtAfy5VZl8N9v/OxiDFpbuG68+VvYkFZ8lE1nzMJsvM2eKiZKtihQrdkr4Yq:qTOxiZhM8+VQiZcE1nzE2eKiotAQrdk4
                                                                                                                                                                                                                          MD5:A81CF3BFB75EC4111F4E9E2829DD7CE5
                                                                                                                                                                                                                          SHA1:9BA549374EE9E78863AA84E432BCCBD402BF6B96
                                                                                                                                                                                                                          SHA-256:E308A653A651F0101AAD1969225AB34E68048568CCF2DCC44812F3579D62E66A
                                                                                                                                                                                                                          SHA-512:4FD29AB7F866049026507DBAC50354D50F348F36BF53666106BA2EDD3AEAA493D9A8D03421B20B8D118198481F4E9DD09FE2B11ECE453058F0791F1527D47EDC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.X.!c..!c..!c.kn...!c..Y...!c..Y..F!c..Y...!c......!c......!c..!b.1!c..Y...!c..Y...!c..s...!c..Y...!c.Rich.!c.................PE..L...K*.V...........!................z9..............................................W.....@......................... i.......V..........8............h....... ..Tf..................................P...@...............t............................text...}........................... ..`.rdata..............................@..@.data........p...v...Z..............@....rsrc...8...........................@..@.reloc..d.... ......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\libleak-64.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3912260
                                                                                                                                                                                                                          Entropy (8bit):5.478262282585278
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:gpMpkpNpUlVxUK0MVPIjNJLpOrpBNw7x1K1zUYjlVScV:gpMpkpNpUl+jNJLpYNw7x1K1zUi
                                                                                                                                                                                                                          MD5:4E8BF72BA9D7975A1372066D89791604
                                                                                                                                                                                                                          SHA1:C0C0D992B9C5828E5AFFD98BD2EBB1F90BE93ADF
                                                                                                                                                                                                                          SHA-256:D53821EE159BC32356B0B63164A52F45B942031A2920BC20140528071F17E49F
                                                                                                                                                                                                                          SHA-512:B7B818BC3B56FA7B3216C0CBBD27AC6700916F7BD9538AA1102A5D7E1F89CFC8A328D377E7C271EC6390FC44A10309E311C0420D58223C8EBF76A29E2CCACF43
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.D@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\libleak.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7475078
                                                                                                                                                                                                                          Entropy (8bit):5.463191189360775
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:98304:QKM7pPpZpXp2pip5C/egKOgKigKvtXaj3buDb:qpPpZpXp2pip5ttXaj3buDb
                                                                                                                                                                                                                          MD5:4C05E9D7398029282F6BC11595220274
                                                                                                                                                                                                                          SHA1:439A6421459EFAC4C36B1D0289F3FA0C06A222F0
                                                                                                                                                                                                                          SHA-256:BB40D2760CB78BC13313673DFABED6E136E1E7B1A69315A7B12CD025CF1FECD3
                                                                                                                                                                                                                          SHA-512:9FF61174FC40AADAAE3B67598D7D2A6D19C842E50E66226D226223062B4FCB3D56484DBA3B4208C0C721BBF342AEFFDC82789D399B44D52C947F931A5F2E93B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.D@............................................................................................................................................................................................................................................................xr.Y~...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\libleakres.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4767228
                                                                                                                                                                                                                          Entropy (8bit):6.045125256980143
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:bN4tdKfpLpPpUpkpOpJpBMp/UcU3B1Vxwch2aSJ:ZfpLpPpUpkpOpJpepE1Vxwch2aSJ
                                                                                                                                                                                                                          MD5:C85918658B1B0794706FEAA63FAAB882
                                                                                                                                                                                                                          SHA1:4E67A1FF11FFE6776B5AF6CFF29CFF3230E8D169
                                                                                                                                                                                                                          SHA-256:9FB7E9DFA6791DBB1772F1328E6D75B80045BCCACF55A9D6926325EC780CBF6F
                                                                                                                                                                                                                          SHA-512:28F568166E6C5D155E2635593E44B033313659F101B09781CD2CD9B5DE1570F04EBAA965C00A47965C488BCABA3F7A7E5F8D852E2A3371FFC2B9292D51AC1916
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.D@............................................................................................................IM.HP.Qv.\b.Zh.DI.............................IM.HP.Qv.\b.Zh.DI.....................Gt.Cv...........................pP.DZ.pi.Ah.dK.iO.Wt.Cp.Cs.Or.iC.kF.i{.Qv.zW..X..~.xv.kW.Wt.Cp.dG.QF..X..~.Bc.ZR.LD.JN.pP.b_.EY.pu.Qv.\b.Aw.cv.FT.uV..}..f..t.............GR.v..sz.tS.e{.dK.iO.Wt.Cp.Cs.F`.sz.oT.cW.Ft.vr.e{.........................GR..}....................................................................................................................................................................................................................................................................................................................................................................................IM.HP.Qv.\b.Zh.DI.............................IM.HP.Qv.\b.Zh.DI..........................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\libredlist.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1556
                                                                                                                                                                                                                          Entropy (8bit):6.7165649393941385
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:bfW/IdkoPWtO9WWyNV7mbkZ76jdREDovoJ+AP2+kI1yO8xpApbXPpmoorQ:bQgNPz97y3leuYn6k0FhbRNAQ
                                                                                                                                                                                                                          MD5:A0E15F52BDDE187619F750E96AFA7E91
                                                                                                                                                                                                                          SHA1:394B03C1664782D1E8F9368DC35E26331B3FEDC7
                                                                                                                                                                                                                          SHA-256:B86FF4265280324B0FC8B089A768142528D11EB6495F7D13277C9673AD88C1CF
                                                                                                                                                                                                                          SHA-512:538C13FE0180F0203A8BEC76B0670FF3A7A31313E1F3F3217987ECB2131DF4ADBB65A94CE5680FF9FB2D2CDFB8F8C6616845D78C903EB774B5AE6205EA413E12
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.................p}LM.(?#+.=A9F....h.v@@j0%>>:*7VZ9.""*+7A5>|...g...VZ9.97.)'TQZ4N....w.rW8%7&.=&cTA^-*A@...}.....+$6V\yV . ?(34>>....i..KLu] !(.?.3\ZAF.....p}LM. (/+.(\A<AK.....{qA0.#%#8;Af). .!HXv`ywi..2;.?^[8).&7.&\H93....b..K@.$ 1!.7@WAK'!A@...vf...n....WU]! .%+.6FS%"LI...vjkp..a....\U()%.+!._MSP*IF....gu..l....\YP\ .#..6/T]"AK....agdzi..2;./Rd 9&**. VY@V6IF....ak...n..*GtAX.(9-&4.AQ-8.1IO..w.z.<8.:;._A+%/.6 3GWF4N....w.vL8.4".)'TQZz6!-> (W9g.~l..=&.MUi(1+#!.(VU8#3NN..~v.z.<8.;;(GA<!$-1.1RVZ\6izg{w;>>.......vj.z.<8.;;(GA<!$-1.1RVZ\6izg{w;>>.......p.w|<0.>.(.FD!)/6.&3]VQKira~b;W9w..l..=&`LUK01<'*4/`W-"/&6hd...XIN.|....w.45.0$ GMDT!*9.,;4]Q>awnph3>2rp......wpq48.7%7&FHY\*1.).44VFazlwi$_9}lt.i..7..GU>843) <FkWX**)8bkj..a-LI...vjkp..a..".`@->564(7]MgZ%*"/=wk..|a NN..g}ff..a..".`@->564(7]MgZ%*"/=wk..|a NN..|.w|<0.>.(.FD!)/6.&3]VQKiu|g.w;>>.zq..h.v@@j0%>>:*7VZ9.""*+7A...ita+BP.zf.....h.v@@j0%>>:*7VZ9.""*+7A...ita+BP.}`.......ag}|.i..7..[U>).&7*'A[Q.rixg.WPzz.......p}LM.,-8*.?@[9>"&is...U

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\modules\360EvtMgr.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):465976
                                                                                                                                                                                                                          Entropy (8bit):6.5625986208029286
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:aNhJLFBtYrJjWRIzPX5h939ciScpxsPOgEPoXfj9:aNh7SaILPZ9pxsPfEPafj9
                                                                                                                                                                                                                          MD5:F351CA96F0B9ACD9B41ED7703C1B0040
                                                                                                                                                                                                                          SHA1:801B4D5047EAE21B2641CBCE58A250A3BE3C8E32
                                                                                                                                                                                                                          SHA-256:73537D69D7E1F5B7D358D2810315F6BF491089657D73C675389C06E283798B92
                                                                                                                                                                                                                          SHA-512:6AC0F6BFF83FF2849ADCD9DBF992A17246CB50ACF0707EEBEE6961969D0C6F8567E6592AEC17AE01E589B69A61BA0D31D3457D2D5101503AD407098727B03C1C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$...........F..F..F.....D.....J.....A....B..G..c..O.M.D....B...k.._....D....O.....G.....E.....L....S....'.....N.....D.....k..F..`.....M....T....H...'.G..F.O.G....G..RichF..........................PE..L....m.^.................Z..........`........p....@..........................@......~@....@..................................2...........D...............;.......<..0...p...................@...........@............p..<............................text...GX.......Z.................. ..`.rdata..V....p.......^..............@..@.data...,V...P.......>..............@....rsrc....D.......F...\..............@..@.reloc...<.......<..................@..B................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\modules\360PatchMgr.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):291328
                                                                                                                                                                                                                          Entropy (8bit):6.81411040635395
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:2b8kCnlGavNtWYBiTMaMsP4TeOIQjki8UJjyn:/l3vNtWgaMsP4yEjV8Ijyn
                                                                                                                                                                                                                          MD5:4DC06FDC0A4F897A070A5D1E94FE509D
                                                                                                                                                                                                                          SHA1:BF524B1F1F848C4BC536D6519A5D147EC2ED5F11
                                                                                                                                                                                                                          SHA-256:F2DE4B4BD9E067095FF3F61423910A6D52EE9841E782C981F84141956A121C06
                                                                                                                                                                                                                          SHA-512:B79F8B9679BF1D3610FFD10C4AF17859F7D57A8CCCF51E4021044E5520AABFCE7FCC907E240CEEC3B20248358E2D2D0783B7AEEF400CA57DB8306DDBBDE5AC1A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......v...2..Z2..Z2..Z...[6..Z2..Z@..Z`..[0..Z`..[8..Z...Z8..Z;..Z0..ZW..[3..Z.:-Z1..Z...[3..Z...[0..Z...[8..Z...[0..Z...[3..Z...[...Z`..[6..ZW..[3..ZW..[;..Z2..Z,..Z...[3..Z...[1..Z...Z3..Z2.}Z3..Z...[3..ZRich2..Z........PE..L...>..].....................8....................@..........................p..................................................x.... ..dB...........:..h7.............p...................P.......@...@...............p............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...dB... ...D..................@..@........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\modules\360PatchMgr64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):355840
                                                                                                                                                                                                                          Entropy (8bit):6.592135175540451
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:aHdVCiZPn9ma6ymq0ZcGkyBU3xBj4Qft3nVoKumC8t/Hn:cdsiZP9maZGkf3fdRa8tvn
                                                                                                                                                                                                                          MD5:A56506EBD1E08EFFA960F5A34164463B
                                                                                                                                                                                                                          SHA1:42231372DB033E278F2F33039208C478AEAB83D4
                                                                                                                                                                                                                          SHA-256:475C6D9D9F224412B8E46328C853ADBD20837E2CAF35DEAAA2721D3263AB4AE8
                                                                                                                                                                                                                          SHA-512:F4453210B57E57DB2FF983E773197D3A62094D58D594B14756E593C6068B03D0DA04F33FAC5F19614454351F99FD2658215DBEF830782A5303E47EF40C282518
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.......... [.s[.s[.s..rY.sR.5sY.s[.s+.s...rY.s...rZ.s.WWsY.s.WTsR.s>..rZ.s.kasX.s..rZ.s..rY.s..rZ.s..r].s...rZ.s..rh.s...r].s>..rZ.s>..rR.s[.s..s..rZ.s..rX.s.YsZ.s[.1sZ.s..rZ.sRich[.s................PE..d......].........."............................@..........................................`.................................................@...x....0...A.......'...6..h7..........pe..p....................e..(....................... ...(........................text............................... ..`.rdata...1.......2..................@..@.data...H...........................@....pdata...'.......(..................@..@.rsrc....A...0...B..................@..@.reloc..............................@..B........................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\modules\KB931125-rootsupd.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):459080
                                                                                                                                                                                                                          Entropy (8bit):7.808234694456988
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:ikfk12vJnVGeGVbT5vQtYnObeJWDPO7RuXawA:Q1qnVGVV3nYeIjOQXawA
                                                                                                                                                                                                                          MD5:9909AA216B30B502F677BFFF05000B0E
                                                                                                                                                                                                                          SHA1:01A26E5C75FF5B3E34FB6B763ACE486FE6836AAC
                                                                                                                                                                                                                          SHA-256:2BFF74B83DC66FC74DF2F527071C1CA80A992BA2B887F6043B09564D1B814213
                                                                                                                                                                                                                          SHA-512:D46D00AA05C1FB08232EA7281D18254EDC55DE5E7D1E681CA5C1C18324F724565A89DED04507DE4F725971301762B91F4AA90A357BB3B09DAD2EA26A676C1C3F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:.L.[...[...[.......[.......[.......[...[.. [.......[.......[.......[.......[..Rich.[..........PE..L.....IE............................$k...............................................L....@...... ......................................................H?......@.......................................@............................................text............................... ..`.data...`"..........................@....rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\360GameIdentify.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):242688
                                                                                                                                                                                                                          Entropy (8bit):6.704264610739677
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:n/Owr72s/KiZNTXnC6F7A1cSQnL/pPp59W6DY2UDGWf+37P/go9TBfMy4kmab5SF:n//7lhF7schPbW60HDGWXo9TBUy9gF
                                                                                                                                                                                                                          MD5:667213B8F9AFEDC4D763C8A51829DAB8
                                                                                                                                                                                                                          SHA1:049DEDA057944D1E209EE15710854754C23BFA4A
                                                                                                                                                                                                                          SHA-256:D7A46B46B3FA7441EF9873F42C93D500809B5E8BDB10C739AA98CAB389A00E57
                                                                                                                                                                                                                          SHA-512:8D087B166CA1607DB97ACBCB3B923E70FF93E798D0076D1C4456C2A940B3C7334B64BE52D0731DB6E4A0A70AE6B4EDADF88DA26DB5F99CEA652FAEE9C2FD78AA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?)\.^G..^G..^G..&...^G..&..?^G..&...^G...*..^G...<..^G..^F..^G..&...^G..&...^G......^G..&...^G.Rich.^G.........................PE..L...q.MV...........!................0d...............................................G....@.........................P=......./.......................|..h7..........................................X...@...............`............................text............................... ..`.rdata.............................@..@.data....C...@.......*..............@....rsrc................D..............@..@.reloc.../.......0...J..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\360gmoptm.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):383756
                                                                                                                                                                                                                          Entropy (8bit):0.21825072848271249
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:JS9akPgURydLSLKPbt9wlKKAPwkGN92462qY4K6D:UzP9ZejtKlROw5N9UK6D
                                                                                                                                                                                                                          MD5:BB4E6253234A6B785675ED349F8424F9
                                                                                                                                                                                                                          SHA1:33238C2A7FBC40D787995DC3517BB54837F27D05
                                                                                                                                                                                                                          SHA-256:817937CB3E34BEF8467D25F0D8B3158B7B19390DA0BC5B3F5301B54557991092
                                                                                                                                                                                                                          SHA-512:00F441A09CE01A68956FBB782D0C6E4C6D6636DA231743B8832C433E5850647B4A3D438FCA26B0710822A8FD96627E6D0415A5C59E8635DBA5DA55F51D725CC0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...........................................................................h.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\360netctrl.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):391496
                                                                                                                                                                                                                          Entropy (8bit):6.298267867246205
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:eKxLTrf9skEzpB3oQw4BpQQZ2c3+HI8XurwzbysZcdLvB1gLB:eKxL/fykEzpB3zd//+HI8XurwzW/de
                                                                                                                                                                                                                          MD5:30C9D5470142EDF4D69B00AFF040F822
                                                                                                                                                                                                                          SHA1:7C21ED33749B58C10AD7E1D95C922244EEC62FCF
                                                                                                                                                                                                                          SHA-256:B76103FF3D6FAA46537D3DB213270A086AE3B5B58FE6841B03CD5F9F73C54247
                                                                                                                                                                                                                          SHA-512:C385B70414823107903FC1EEC608B064360337114DC8A6D307F2CAAD9EC5EC7E53A2850F26B5374DEAA97B2C727206F08A0A2037D12550E6449632D165B03B7F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f...f...f.....f.....f.....f......f....?.f..H....f..H....f...g..f.....f.......f.....f.......f.Rich..f.........PE..L.....]...........!.........................................................P...........@.............................2......,........1...............6.......8..0................................g..@...............d............................text............................... ..`.rdata.."...........................@..@.data...@........D..................@....360_NET.....p......................@....rsrc....1.......2..................@..@.reloc...............4..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\Netgm.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):422496
                                                                                                                                                                                                                          Entropy (8bit):6.51973175241758
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:/6G8mxfMfxNjVPcQA0eTRs9pSeqn6dc3Ik:/6G8mxojV+TRs9Qe+6dg
                                                                                                                                                                                                                          MD5:E9DFECD52DD8F7E61DFDFDC2C9589808
                                                                                                                                                                                                                          SHA1:04D4EE32C5277D4CA58272A50E984BA21F5D77FE
                                                                                                                                                                                                                          SHA-256:6700143A2AD67F41CB0776D02B6F304B25F7294C20ABC55EC5D276A41C48A6B8
                                                                                                                                                                                                                          SHA-512:7539FB8F0785EF505D649FE75B8C166909AFCDBA4173DDCC5C0CBFD7809F1F0B2E6EA985BCA055FE54727BDEAB236D4B3141E5DCA74B75AD99C54EA74F1929EE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Mu..#&..#&..#&C.&..#&..&.#&..&E.#&...&..#&..&..#&.bN&..#&.bX&.#&.."&.#&..&.#&..&..#&...&..#&..&..#&Rich..#&................PE..L...$..Y...........!.....\...................p.......................................v....@.........................._.......N...........Y...........<...5...0...,..@t..................................@............p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data....Z...p...4...R..............@....rsrc....Y.......Z..................@..@.reloc..&X...0...Z..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\NetworkMon.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2021376
                                                                                                                                                                                                                          Entropy (8bit):6.39991298760676
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:Wn0fN7NxI8h/CG8rG9YFnFBJ2+W4U5ToVVsnHzlqNwQnyNP:Wn0e8Qr8+nFB8b4U5TM6nTlVQYP
                                                                                                                                                                                                                          MD5:125664A503F5E960DE04CC059A97F692
                                                                                                                                                                                                                          SHA1:7F82B8A837C3B5D32556FF40F85C902AB62970D3
                                                                                                                                                                                                                          SHA-256:27493B9BF6590B38982917B43BADA415A13836A022897266CB83A53AC9CB44BF
                                                                                                                                                                                                                          SHA-512:490D9287A3EAD26355D7D381C92082F94C329E44D5610DE512FB637DEC53DC4FA995AA424FD79BA361A5D87FC7DC42A7E45C25338E52A1732E152BEDFF2B6A17
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M..}...}...}.:.....}.......}.......}.......}.......}.....C.}.......}.......}...|...}.......}.......}.......}.......}.Rich..}.................PE..L....=\.................F...T......V........`....@.......................... .......7....@.....................................|.......h...............h7...P..D....i..............................X...@............`...............................text....D.......F.................. ..`.rdata.......`.......J..............@..@.data............>..................@....rsrc...h............(..............@..@.reloc..h....P......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\NetworkMonUI.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076224
                                                                                                                                                                                                                          Entropy (8bit):6.528280012782545
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:Os55Re/qHpsfkfq/xXWo5mn2CMnPPV0yY+IFUULxELa8vDEXgW4gpmbGlhguISzX:BIGpsfMxNMXumDEeg4bahgulP/
                                                                                                                                                                                                                          MD5:77115A94FF728666F5CB63C7DE3715B8
                                                                                                                                                                                                                          SHA1:A873AA5D943BFA6FD62499F0C6AD23294C575A75
                                                                                                                                                                                                                          SHA-256:DD29A6F6A9985739368BA52FD049C94CE31FAD06A65831573CBDF06B66EA4A28
                                                                                                                                                                                                                          SHA-512:B56259D71DDB95D7A64A9D5200210D912F4B55E3FB53B350E9923E0AD9FA241C00BEEB337D0FB86F60BA78136D27FED166A7B1DC23DF4B08F9803A0A107BF71F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........WV(.68{.68{.68{_y.{.68{.N.{.68{.N.{.68{.d.{.68{..V{.68{.N.{"68{.N.{.68{..U{.68{..C{.68{.69{.48{.N.{a68{.N.{.68{.d.{.68{.N.{.68{Rich.68{........................PE..L...SE?\...........!.........F.......g....................................................@.........................p...d.......h........3...........4..h7..........p...................................@...............D............................text............................... ..`.rdata..............................@..@.data...........R..................@....rsrc....3.......4...2..............@..@.reloc..$............f..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\gameidentify.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:zlib compressed data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):91664
                                                                                                                                                                                                                          Entropy (8bit):7.976490209780711
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:2tIvQv/DVTLh9bQsyL2Amk9e728x7+i1PjrqD4+70bVJZYKI6F5JKMDT:2tIOhTLTbaL2X4e7227+i9j+4s0bNIKF
                                                                                                                                                                                                                          MD5:9D3D83EDE03360B412DED14DB46593AE
                                                                                                                                                                                                                          SHA1:290046CAE3C66D5A70369433CA1E447EC931E004
                                                                                                                                                                                                                          SHA-256:5640E67C3E3775A8BC4F99A618DE18C6EB1BD4D674A41703BA28E570628BAA7B
                                                                                                                                                                                                                          SHA-512:FA776DC6A1EFD38501EE7983DE05BC89FB834FDB83A23DB593888433694C51970FAFE7C669D0CF803753B64E0F5231FD3F31DF6D3A27760A991E7289EF2B75E6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:x....%.y&.d.R6...4Ak.1-H..w\......$53=3....5..}....=...p.H.6b..J..d.,y.....6..z. A.............^/..c.....@P......8u...V....:U..s.....;.....]...k...5.G./..];X.....x.....N.s....SkO..<v...#.kW.......c..nk.C.........:F..#.l..k....1.wz..:....v.....gp.....w.....;............x.....p..F...3.7].d.=]...7'.......k.Z...f.~..?........$;....y.wg?..w3.....a..x..I>.#.1......*..[;..~3......b......;..w...O...+.[x)..z.......n...+...7..;..f....+W.0{.i..f.b.g3[....WA.....k..~K..f.w..{8>..n...e?.u|=....._[d...=...J.......^s>.Q.N.o.r......S.....3.b..lD..W...av..3...l.|.6;.{..m`.-.(._s&s.q..'...[.nm;.....>..B..Cf..B=B.T~...'I ....1.*.z...!_)V..(..f..##..e?..?....w?...9.'.+.o.D...R?]...'...lD.w8....OjeO3.<..|.=.?.......r.Q.\....O.d.n...?.1|....*..d6^...*..x..3..v!......8xF..!....=<m..o.=.f.l...t..s...W...]..f...e..1.W...`......|...Y9V^.=^..=.V..p........X.......`..+?..........*..../@.O!i....*Q?.fv.s..z6..6............=/..8.-.bg..-..8..3xLf......0........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\50\360netmon_50.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):352632
                                                                                                                                                                                                                          Entropy (8bit):1.7997016249408833
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:rwQgnK5XD1eK1slb5V5OgWuXM0vtJzkPoWgU0gYNjEqjYA3whFW:IpuGb5VFjDNWoWgwcQMpghs
                                                                                                                                                                                                                          MD5:61132D719D082DE8D27254442E63556B
                                                                                                                                                                                                                          SHA1:8D88370D17E0E068502D219C854EE5151CD6231F
                                                                                                                                                                                                                          SHA-256:7F74E76E318ACFCB3D26AC014D92DB39C2D130384F6C1214C373D24D0F4A68D1
                                                                                                                                                                                                                          SHA-512:E3876F7E1869F322D6FC352DB0E269D68CE9E450E085BBA7F0FB2C7C06401E37BCADD531249C69126AFEC35DC4DFD39EDC99942D924E117BBDE093DC0BF36CA0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$................q...|...Yb.a.&......e..*{g2`.%...X.\Mv.SO..N.c*....FOb.Q.U..o/..6....u.=.K.|.s.......v!. .f..../.H.T.[.K%@...=...[....Y.........................................................................................................................................................................................................................................................].m.<.>.<.>.<.>.D.>.<.>.<.>.<.>"3.>.<.>"3.>.<.>.Di>.<.>.D~>.<.>.D{>.<.>Rich.<.>........................PE..L......Y.....................}......>.......................................................................................P...d.......p................A..............................................@............................................text...7........................... ..h.rdata..............................@..H.data....e.......f..................@...INIT............

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\60\360netmon_60.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):79992
                                                                                                                                                                                                                          Entropy (8bit):6.795734984946143
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:k7+PEPwPhZj4xc2gTKSvocIN5jwH+PLnghf:CwExc2gWSghN5jwH4Lk
                                                                                                                                                                                                                          MD5:A1C23F63E3B99D1760848FDD78318228
                                                                                                                                                                                                                          SHA1:536FE3E76D7FC54713E14665CF68AE02F92697F6
                                                                                                                                                                                                                          SHA-256:0D8B4BF9C886DD4F28BC5A49EFBC36E97D30494AC2695E21971E94E3A1E41E65
                                                                                                                                                                                                                          SHA-512:A59EA471DC30B91FA4B92F9324AA53417FEFDDFE891BFF26988E021229A324326E6EA7954A89ED4A64E3BE489D044EAB0ACF9AF52A1046525684F9FE225EEA1D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.............?...f.D..l..-.w.x..p..W.....K..M\O.b.q....d.v:...D....=#.X...<..+i..6.4..C..m.C...._.|...A...\...qx?.&J.k....N~.c/0..y.7.....Y.r......................................................................................................................................................................................................................................................0..\t...t...t...t.......}.i.....}.o.p...}.y.g...}.n.u...}.k.u...Richt...................PE..L......Y............................>P......................................................................................PP..x....`..p................A...p......@...................................@...............<............................text............................... ..h.rdata..............................@..H.data...8f..........................@...INIT.........P..................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\wfp\360netmon_wfp.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):88744
                                                                                                                                                                                                                          Entropy (8bit):6.902815768677216
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:g7+PEPwPhZj4xc2gTKSvocINfjwH+AXrM/ghZ:+wExc2gWSghNfjwHXbT
                                                                                                                                                                                                                          MD5:A69BABBD42F7E99E5E52BE58948C558C
                                                                                                                                                                                                                          SHA1:ED0D246D78FEF66254D8774AF0CC81ADB7BDDE32
                                                                                                                                                                                                                          SHA-256:D6998F97566661C2E39AAC4DBC31A0FA4D8A0A1857CCDB87C6D8934A6CA6E751
                                                                                                                                                                                                                          SHA-512:DB89FDD62255B74DB2AF3FF51D89BD25028058AC35CD8D62D014B3C95ACEFBB721F96D035136DDE50249B1FD6F00E066FD8C58326067B78F1581A6FCF0288340
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$..............+K.O1B...l:.GQ....m....u..q...C`I.HD.8+. x.y+.0I.Wa~%.o.?....bM..o4..,r.Z2..y............1.H..+..~............3.g......D..YU.......................................................................................................................................................................................................................................................0..\t...t...t...t.......}.i.....}.o.p...}.y.g...}.n.u...}.k.u...Richt...................PE..L...M..Y............................>P...............................................=......................................PP..x....`..p................d...p......@...................................@...............<............................text............................... ..h.rdata..............................@..H.data...8f..........................@...INIT.........P..................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\wfp\360netmon_x64_wfp.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):96424
                                                                                                                                                                                                                          Entropy (8bit):6.7014457295101515
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:Fyp3RxT/m4r6HklEFE0qRkTJov2dcM8ghS:FyhT/m4r6HkqFEV4Jov2Wf
                                                                                                                                                                                                                          MD5:8A4AFAE6680B973ED303B67F7A82A6C1
                                                                                                                                                                                                                          SHA1:FD2C88542F8D295F253A1C229F8BAB8A35D2C26D
                                                                                                                                                                                                                          SHA-256:70E08AF709B8575C5560A6D68E90E445685CF9A6DFD3E02077E9202A8897617C
                                                                                                                                                                                                                          SHA-512:1CC261F129FB7E1844ED231AA717FD908A3E16F9AD121D1BC3BF15C2E76B95B42F2525B00AB0596203775D19E304488E4F9107BE7BBAB979BCCE7F1BACFC8C26
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................$kxU`...`...`...`.......ir..i...ir..c...ir..f...ir..m...ir..a...ir..a...Rich`...................PE..d......Y..........".................d...............................................Hr..........................................................d.......p....p...........d...........................................................................................text............................... ..h.rdata..............................@..H.data...xm..........................@....pdata..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netdrv\x64\360netmon_x64.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):87672
                                                                                                                                                                                                                          Entropy (8bit):6.569099471603581
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:8yp3RxT/m4r6HklEFEXqRkfJovlFJMZwgh+:8yhT/m4r6HkqFE+cJovlFJY0
                                                                                                                                                                                                                          MD5:B1E1E8C5420CA5D39A3868B4CF0251B8
                                                                                                                                                                                                                          SHA1:B70587C35379206FCDCC9B368567425BEBD3B171
                                                                                                                                                                                                                          SHA-256:4F622357BB25B9D0C211FA2472B1D2ABCE42C2FCB763BCE6CBD89F7AFE42E83C
                                                                                                                                                                                                                          SHA-512:C3C5DFFF25D0BF33850550C85177BAD1C78FA5D6F5BF8C1ADEF5E7E89F5ADCCCCA5E1410ED7741331F08ED63F53E2E28224AAB9107EE5F482CC283B9ECAB884E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................................................................................................................................................................................................................................................................................................$kxU`...`...`...`.......ir..i...ir..c...ir..f...ir..m...ir..a...ir..a...Rich`...................PE..d......Y..........".................d...........................................................................................................d.......p....p...........A...........................................................................................text............................... ..h.rdata..|...........................@..H.data...xm..........................@....pdata..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\netmstart.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173992
                                                                                                                                                                                                                          Entropy (8bit):6.608342733764905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:4kWyRk2rLXSNq94xXPyCgZLO8JztAhpFFRssaS5wHXmwnv1n:jWyBPh6x/yfBO8NkM31
                                                                                                                                                                                                                          MD5:B1F70F9BE9DF8BB186C5BC5159690A1F
                                                                                                                                                                                                                          SHA1:0C9347AC3245CDEB8DCEA9B3EDF01FE4CFD33FE2
                                                                                                                                                                                                                          SHA-256:CE993F7583B1F253C6D82027B89FD867390EA1563564DA75684D293539EDC6A2
                                                                                                                                                                                                                          SHA-512:188419D1CBC4F1B1BEC99BF77F716BB004A0228D3D36ECA9D2E479735EFAE8970DFF62F5DF42F01E8174173537F0D68AE37B9D5B70B0698B52F50EE0AACC5231
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'%..FK.FK.FK....FK.>..FK.>...FK.>..FK.0.FK.FJ.2FK.>..FK.>..FK....FK.>..FK.Rich.FK.........PE..L....8.X...........!................&.....................................................@..........................-...... !..x....................r...5......t.......................................@...............8............................text............................... ..`.rdata..kN.......P..................@..@.data....K...0...(..................@....rsrc................D..............@..@.reloc..`".......$...L..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\netmon\sysoptm.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):292264
                                                                                                                                                                                                                          Entropy (8bit):6.545131288165363
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:3af3sK65dlg0ytSGATnCMVVwR31jx6t3UDTSH+FWNgsAIW:K/s35dldytp2nC8eNNx6tEDuH+FAAIW
                                                                                                                                                                                                                          MD5:94C44279545EC3E426DEE2C8BD29E660
                                                                                                                                                                                                                          SHA1:C123B3C42230A8C18E56DDCE4B1CD3A03CFF8EBD
                                                                                                                                                                                                                          SHA-256:70F0B588BC10782951DC4250299ECA41812CBA10A99FC68D7B5C7E14C0F123A8
                                                                                                                                                                                                                          SHA-512:57D947E1994481CD06BC392DF78ADE511CF9D800D1C8807B1FCD7D5B5FB6C43BEEC9AD2B2CC6948902771C85B4EEFBC6AD9957A04E98BF6C256C2B41CC1CCC1C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............R...R...Rh.dR...R.gR...R.qRW..R.vR...R.+.R...R.+.R...R.+.R...R...R8..R.xR...R.`R...R.fR...R..eR...R.cR...RRich...R........PE..L.....8X...........!.........>.......'.......0......................................*5....@.........................`................0..P............@...5...@...(..07..............................h...@............0..P............................text............................... ..`.rdata.......0......."..............@..@.data...(K.......*..................@....rsrc...P....0......................@..@.reloc...=...@...>..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\rpi.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):972
                                                                                                                                                                                                                          Entropy (8bit):6.330528516114726
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Mleg3ZlR/wZaxCtcrpoqxLmI3BMqKjYHCn:Mlej4xCurpoq1lMqtHCn
                                                                                                                                                                                                                          MD5:996128C6816354D95790057CF2684974
                                                                                                                                                                                                                          SHA1:F80725777E4993BF52C2EABBEC70CA09389F86A6
                                                                                                                                                                                                                          SHA-256:6859420DC99B4AE0A74DBF4B5CC60C10ECE3B342954BAD96C67E6634F57F96B8
                                                                                                                                                                                                                          SHA-512:0761AD90C0DCB4E8C80C80991525C2A8410A59C5176E27D5DE8A3FC32D15FCEF0E6F3476082141E7140A85C01C4E2DE49925267E0DA67F28AE48B4C762C9B7BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...0...0...1.0.0.1.............................................i..................................................................r.p.i...s.i.g.n........................................................................................................................?...^1..M.l......v...3........I...$.+.-...?;..vF..a<^<flT[#0..m.F(>Y.G(..[.4.u.L#.5...4>d....V?...F...LL..an.H.s.....<....w....$.....b.........t.<.......b................5..y.......$.=d....P1Q....':.YW......] I7I[.IPM...D.Gg......+(.<...Z.#.._....Y/.v.f&..B[z7.... .)Ce^(Q.<.KC^......pa.....oOf?....g\_}:...u....a....T...F,....U.Z...r.........^YL.:..dXZK.9S.-...Y.&.4}y...y.S.....I..?f......&g<1.<%~.N.Cb...;O.;.<a.xd.......DK.~...<T)....N\..;..lT.~....2...~.Pn...%$.:.R.a.l....Wi...(.]v...}......X9y>h....]..W.7@....{r..pB(..P||.....P....aO#...2..s......[F....we.p.=.n...g...d$.If.E...,..._..5..k0Y[. .OgD5....^._.....1pX...!. ...1].h.5\C...*..e..*..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):28989
                                                                                                                                                                                                                          Entropy (8bit):5.452948889032923
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:ZwCGYdy9DVX9suel0zditgqqqqqqhjPEzDC/7k939pqHonAntUJ0VqefE:21ps+jPkckmost/oec
                                                                                                                                                                                                                          MD5:B61BB7CC3DD2DCB9B3E093FC38DF599A
                                                                                                                                                                                                                          SHA1:C9FF0529A1CED9AB8D6C30F30BB10F8E1EF3A084
                                                                                                                                                                                                                          SHA-256:A3C8DD27D5F6CBE301E73C13828D4A07D34D888EC4EA6ACD7AF322366EA82C06
                                                                                                                                                                                                                          SHA-512:D842847BCD175C1592031658F084EF0028DC58393BA5D8701D4CF53AEA4A36B2AA56DFFA7A99E90F6B126D1B11B5683D4174D9B7F1BD08D12261F01AA386DE2C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:360G%^.................p.....360G........<....6.G.6.G`6QGU6UG.6UGK6UG.6lG.6.G.6tGV6CGX6qG]6QG.6UGK6UG36.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6..LpG370G;ApG.6.G370G..)G..)G370G..)G370GS.)G..pG.RpG.....)G).pG7>0G340G..)G370G..)G370G.50G360G7>0G370G..)G370G..)G370G.50G360G260G..)G370G..)G.50G7>0G360G.@pG{4.E.4.E.4.E.4.E.4XE.4.E....@....6.G.6.Ga6QGT6UG.6UGJ6UG.6lG.6.G.6tGW6CGY6qG\6QG.6.G.6UGJ6UG26.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6..LpG270G:ApG.6.G270G..)G..)G270G..)G270GR.)G..pG.RpG.....)G(.pG6>0G240G..)G270G..)G270G.50G260G6>0G270G..)G270G..)G270G.50G260G360G..)G270G..)G.50G6>0G260G.@pGz4.E.4.E.4.E.4.E.4XE.4.E....8....6.G.6.Gb6QGW6UG.6UGI6UG.6lGu6EG\6@GD6@GT6BG.6UGI6UG16UGI6UG16.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6.G.6..LpG170G9ApG.6.G170G..)G..)G170G..)G170GQ.)G..pG.RpG.....)G+.pG5>0G140G..)G170G..)G170G.50G160G5>0G170G..)G170G..)G170G.50G160G060G..)G170G..)G.50G5>0G160G.@pGy4.E.4.E.4.E.4.E.4XE.4.E....:....6.G.6.Gc6QGV6UG.6UGH6UG.6lG`6B

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360AV.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):354912
                                                                                                                                                                                                                          Entropy (8bit):6.546028494396802
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:0mURJe4N265tsWSVCV4g7ACyL59H14GZT3urd7jN/r93nH64kPCAI2f5VTZNq7OB:0mURJeL6BSVCV4g7ACyL59H14GZT3uri
                                                                                                                                                                                                                          MD5:64D1FFD07A60D6BF48432C7EBF14F72C
                                                                                                                                                                                                                          SHA1:7AE2C9178EEAA79E3168632ACC671BB98B4EB25F
                                                                                                                                                                                                                          SHA-256:C746D998E7BFE627F1BF4DB28F76E68388017A8A343305BADD0B623534A0D2DC
                                                                                                                                                                                                                          SHA-512:D495647A6262EE08A8EB8BAE1D95B7401381F2B6536D50896ED99C3895509C0C04174D12BCC17C4FC70EAB555E83285B6625BB361168B7DE3A0FDA999D0981F0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}rS.9.=.9.=.9.=.\..;.=.0k.. .=.'A..<.=.0k...=.0k..s.=...P.:.=...F.$.=.9.<.z.=.0k....=.0k..8.=.'A..8.=.0k..8.=.Rich9.=.................PE..L...F.KY...........!.........4............................................................@.............................e............0...............4...5...@..|3..@...............................`f..@............................................text............................... ..`.rdata.............................@..@.data...|S.......&..................@....rsrc........0......................@..@.reloc..pN...@...P..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360Connect.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1727208
                                                                                                                                                                                                                          Entropy (8bit):6.621977935296855
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:TULYTkfK1cDqS46tR8by1HyqChaHg9I2M:VkoGu6j8bvsHxv
                                                                                                                                                                                                                          MD5:8F0D6845314D33F78052ADB9352A3E24
                                                                                                                                                                                                                          SHA1:C51301DDF202E0C692DF525441B333C1F6F596C1
                                                                                                                                                                                                                          SHA-256:EB848A9E2D174BFD268DBC825947D9A1691A3DF7E001F6B580976F31CA3889CD
                                                                                                                                                                                                                          SHA-512:B25A0625B7ECF815BA812DE4BC94A0CB0070CD5DD86EEA09FCA385C9C659D189A94137C8366B1A0F0D604FC6BD9D46F24A9E861B664DA57BA27C757214FBC9FC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o'.P.I.P.I.P.I.w.'.Q.I..A..U.I.Yv..p.I.N\..T.I.Yv...I.w.$.V.I.w.2.u.I.P.H.W.I.Yv....I.Yv....I.Yv..Q.I.N\..Q.I.Yv..Q.I.RichP.I.........PE..L...9..e...........!.....6...........B.......P......................................Tz....@.........................`A.......&.......@..................P,...P..,...`d......................h....... ...@............P...............................text...N4.......6.................. ..`.rdata.......P.......:..............@..@.data........P...~...,..............@....tls.........0......................@....rsrc........@......................@..@.reloc..xw...P...x..................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360GuardBase.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):226416
                                                                                                                                                                                                                          Entropy (8bit):6.452719382706426
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:cv9v03dZChdRIXycLVFRfZfy39V5ni6L4/DIg+XFoLGjaa5HuX2IC:a8qAXtRZy35HL4rIgOTYC
                                                                                                                                                                                                                          MD5:56F3ED370A34A26261DFD509FF506A6D
                                                                                                                                                                                                                          SHA1:6C5124AC8567B6FC80F08B0A4B77EE737D85D35C
                                                                                                                                                                                                                          SHA-256:90ED429E5DBB6E529DB5FD04B6890545AA540C3A7B7B99968E8EB235E2A37848
                                                                                                                                                                                                                          SHA-512:FCE65A64BFDF0AC598F3FB0FA363B5D293EC742C466F012FE9BF004564FE74C0456A51BF53A3AACCC222148CE8A164D81ADC7D83D8A3008BC3553C8EDCB689E3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n................................ .....................m.......{.........q...................................Rich............PE..L.....7V...........!.....l...........W...............................................m....@.............................o...x........P...............^.......`...".................................. ...@...............d............................text....j.......l.................. ..`.rdata..oo.......p...p..............@..@.data....[.......0..................@....rsrc........P......................@..@.reloc..~A...`...B..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360PrivacyGuard.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1146776
                                                                                                                                                                                                                          Entropy (8bit):6.453959671451318
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:6XiJleTz+MDLnaWjxgUC7Vz7XL+6gvfHcr8N9/t:6gSZNDC7VHKrvfHcrYt
                                                                                                                                                                                                                          MD5:C22BED1A7A0B6F198FC91FAC3351EB23
                                                                                                                                                                                                                          SHA1:9DC48886F3D0DC8E2B2386C4CB9C241F17E71D8D
                                                                                                                                                                                                                          SHA-256:B94FE75ED0120A29DC1CFF46CD7C2554006424C6F7D18219BABD95B287E66846
                                                                                                                                                                                                                          SHA-512:6676700934D97861FB62767478596D3E410B07BA809F1E2FAA94E32782401F9BB7E27C6F3FFC6948E76886426C72BCF8E251906AAE80F4B8F5EA21A6CE20A313
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b..b..b.d-G..b..0U..b......b......b......b..b..a...D..b...R..b...U.yb...[..b..0E..b...@..b.Rich.b.........................PE..L...~.+c..........................................@..................................6....@.................................4).......@..|u...........6...I......d....................................-..@............................................text............................... ..`.rdata..............................@..@.data........`...X...B..............@....rsrc...|u...@...v..................@..@.reloc...".......$..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SPTool.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):169080
                                                                                                                                                                                                                          Entropy (8bit):6.412737608465599
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:xmryqHeJ22Xs/l+ehDp4kZccLd2S5S+tDOOMs+eoz3nYwPruUoR:QZ+Jzc/bWkZccLkSS+UGkYwDCR
                                                                                                                                                                                                                          MD5:259AFFE7B271B29D4B04D678C94BC776
                                                                                                                                                                                                                          SHA1:073F326B4CE111ACE97DF011F8FFB78BBEFCDBD2
                                                                                                                                                                                                                          SHA-256:92D35442715CB9C7DEE115E146DAA72BBB5C408AE03BB6BB5B6F834FF1867444
                                                                                                                                                                                                                          SHA-512:E042C2ECB0F2F53A2D1555799D30AFF474DFEEA01033761F7F9298FA5575F5C23DB5819BD850209C1B916BA3D7BD8F32A31C8B81AB9AC65A0D0A27BE353AEB63
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...6...6...6..A6...6..S6...6..B6...6..T6-..6..D6...6...62..6..]6...6..C6...6..F6...6Rich...6........................PE..L.....U............................).............@..................................)....@.................................<........P..P]...........~..................................................@...............D............................text.............................. ..`.rdata...P.......R..................@..@.data....F..........................@....rsrc...P]...P...^..................@..@.reloc..\ ......."...Z..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SafeCamera.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):441088
                                                                                                                                                                                                                          Entropy (8bit):6.7826949893623905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:KLdgN/zTpLsCK9yNl9sOERzCUsvyhtOp9cP0Q2liUlYa9I:s4vQAo0QabYa9I
                                                                                                                                                                                                                          MD5:B069B9E19603F21DE974803C8DB1A8B5
                                                                                                                                                                                                                          SHA1:1BCDE0CF0FD97721C70D132E2E2CF034A4EDB886
                                                                                                                                                                                                                          SHA-256:0807681FDF3E18CB3E6EA76BBFEE9938FC9B1AFD9B198F033D44467B3554FA19
                                                                                                                                                                                                                          SHA-512:89D22BA35D9CD2FE5CE9DC1B5C2F7EECDABEF7758608BA8AD7B75A491FF6E0EA4B748999146D2A339D2811410D1C6A85F70A7B09EFECDD9611E0B642D74E49DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k9../X../X../X..& D..X..& R..X..& U.~X......-X......8X../X...X..& [.9X..& C..X..1.E..X..& @..X..Rich/X..................PE..L.....u`...........!.................9.......................................0............@......................... ...U...............X............x..hB.......)..0...................................@............................................text...s........................... ..`.rdata..u#.......$..................@..@.data........ ..."..................@....rsrc...X............(..............@..@.reloc..zD.......F...0..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SelfProtection.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):200464
                                                                                                                                                                                                                          Entropy (8bit):6.294026800781872
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:qdYrsP4L0KuHee7i5QM15T2MPcGu2E2x+G+7yPV95EJ:JstHoFT2s092Lyq95U
                                                                                                                                                                                                                          MD5:A190AAAA3DEC18E80A47398FB17255D0
                                                                                                                                                                                                                          SHA1:7C60BAD828CB115A296FF71061AD0DFAD4E642C8
                                                                                                                                                                                                                          SHA-256:975E305170DB54A40577610024F11CA2312D68A33DE546237A2A716575C0759C
                                                                                                                                                                                                                          SHA-512:3F5FB8BED35354C929614D280676A4B03F8E1BF5F14A1BBA9218481D53641D196F6CB50D37FE3153366AC77A2143D01B5179CB22E0F9AD89F86279069C6C7749
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$..........`...vq...b.B..........pp..2..&h".....W...v....-...B...........3!f...G..\....7...5..csb...KTZK..I.EyK........[...1..f..r.....`........................................................................................................................................................................................................................................................?...{O|.{O|.{O|..@s.zO|.{O}..O|."lo.~O|..G#.zO|..@#.yO|..@".zO|..@&.zO|.Rich{O|.........................PE..L......`............................................................................Gh......................................8...<........................B.......#.. ................................+..@............................................text............................... ..h.rdata..$0.......0..................@..H.data...._...-...`...-..............@...INIT............

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360SelfProtection_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):209088
                                                                                                                                                                                                                          Entropy (8bit):6.374492867856251
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:CdYrsP4L0KuHee7i5QM15T2MPcGu2E2x+G+7yPF9xEJ:xstHoFT2s092Lye9xU
                                                                                                                                                                                                                          MD5:B91EB9971633E1E9977F78F812451E36
                                                                                                                                                                                                                          SHA1:A7FE979765AE8BDF2CD510E65EB9D5B33AF66993
                                                                                                                                                                                                                          SHA-256:B46DA2101BC89F83A4DC004D1A456D014AA58BBD629AAE83F69284D2BBE7C34A
                                                                                                                                                                                                                          SHA-512:A867DE148BA642D3EFBABBCFFE1CABACA525C016E16E836039D515A63D4064FABCC3BDB9AA29D75100646AA088A3FFF68B292CA0383D2BB462FE28DF33E85D03
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$..........`...vq...b.B..........pp..2..&h".....W...v....-...B...........3!f...G..\....7...5..csb...KTZK..I.EyK........[...1..f..r.....`........................................................................................................................................................................................................................................................?...{O|.{O|.{O|..@s.zO|.{O}..O|."lo.~O|..G#.zO|..@#.yO|..@".zO|..@&.zO|.Rich{O|.........................PE..L......`....................................................................................................................8...<........................d.......#.. ................................+..@............................................text............................... ..h.rdata..$0.......0..................@..H.data...._...-...`...-..............@...INIT............

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360Tray.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):413000
                                                                                                                                                                                                                          Entropy (8bit):6.638737677700079
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:SzRfZEg37ng2c/wFzIyNHO94JSgdJLUltGb9Ku/fw54LhA63r3n9:SzRfZXnzR9O94JSgdJASbh39b39
                                                                                                                                                                                                                          MD5:57B51D223396DCD333A943859A9AE200
                                                                                                                                                                                                                          SHA1:FD809931771F535B2AE2B73C52F7C08BCE319D9E
                                                                                                                                                                                                                          SHA-256:ABC0DA03C59F60C7F99D40EFFDA14C05057134082B681E776F18D2BBF21CF459
                                                                                                                                                                                                                          SHA-512:85CE88DC0F47D2BE07EDA6A440F4E54E9AB12BDBABEF28A80A1B2FAE85B4DB76ADAF5B59DA7E9B5F03ED4A309CAB6D1E6E61E141CD243EC566B78C6B7B4B4316
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.BC..,...,...,......,.......,......,.%KB...,.......,.....[.,.%KA...,.%KW.!.,...-..,.....H.,......,.......,.Rich..,.........PE..L.....%].............................j.......0....@.......................................@.............................................H................6...0...5...4.................................@............0...............................text...<........................... ..`.rdata..0....0......................@..@.data....x.......$..................@....rsrc...H...........................@..@.reloc...b...0...d..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360UDisk.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):765952
                                                                                                                                                                                                                          Entropy (8bit):6.5323374564219305
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:zSM/9QOSCX0cZp9J3KkbntLA9fjZD9rJvm8nePsh67gv1pNqu42zMw7wj3Tn:zS+9QEnnskbsfjs3PmpNquJzr7wT
                                                                                                                                                                                                                          MD5:972872A0667FF3E04B7E2BE15296A07C
                                                                                                                                                                                                                          SHA1:EC138986A3E1A17E21080D377AE37D93EA1931CC
                                                                                                                                                                                                                          SHA-256:529FDE10DD3AFE5B6DD4358C9557F04D4191089759E2DDC00F349DE584A72FFC
                                                                                                                                                                                                                          SHA-512:AC533D48C94E3AAA35526CB36B90C61B1EA7DAF6D07C10DD754E43FFA1DE986641478DB5623418889DB8DA7D98C4EE2153E1EF9EFD6A096F83720B57160FEB45
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^................d.....=t........u.......r.......u.B...=t......=t..=............{.H.....c.......e.......`.....Rich............PE..L.....N\...........!.........b............... ......................................,R....@.........................._..P....<...........S...........x..h7...p..Xg...(..................................@............ ..P............................text...|........................... ..`.rdata..@@... ...B..................@..@.data........p...@...V..............@....rsrc....S.......T..................@..@.reloc..>....p......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360bsmon.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):293768
                                                                                                                                                                                                                          Entropy (8bit):6.702259280092388
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:4cQOr6gMDyy1U/U/JBYnJgvHLRzINuqpEwESlz8TBJtcA7QTlHBM9q:Br6l1U/UN90uqpErW8TrR7X9q
                                                                                                                                                                                                                          MD5:39667AD8CA608535C7854CFC82380D23
                                                                                                                                                                                                                          SHA1:414F80C7796F80E4643EFB7BA949CE51E6ADE63E
                                                                                                                                                                                                                          SHA-256:16295273A233DBC448687A970CC9DF27E55C943C637CA0E5903F222816AB8877
                                                                                                                                                                                                                          SHA-512:76F2DD41CCE5C1298A1526959E7F2EC7A8389D1C3A2726BA74506168A15F35E4A097B42FEEF8F03CA977DCC0CA3D8635DA95BA368D6CF35B2A2A888CCF70EEFD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.;..gU..gU..gU..(..gU......gU.....gU....HgU.-.8..gU.-....gU..gT..gU..../gU.....gU..5...gU.....gU.Rich.gU.........PE..L...`..^...........!.........8............... ......................................6.....@.............................T............`...............D...6...p..h'..."..................................@............ ..t............................text............................... ..`.rdata....... ......................@..@.data...@_....... ..................@....rsrc........`......................@..@.reloc...;...p...<..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360calaInt.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):36668
                                                                                                                                                                                                                          Entropy (8bit):7.988819906726455
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:8zQTM13o/8Ef0hPtDWLh9tsbML3R1JZowU1+42qSQrIjrzK+7sm:0BY/AlDWd9Sk1JNO+4dTrI/ztL
                                                                                                                                                                                                                          MD5:0D0A06358EB643B813FDC2C713A68482
                                                                                                                                                                                                                          SHA1:D7DBAE7CCD68453EC54BA951D214FED96C1FCA21
                                                                                                                                                                                                                          SHA-256:7D821CE879F733CE0B9B9ACFC226346F84B4C06628A0A6D64A065E9AB0449CC5
                                                                                                                                                                                                                          SHA-512:B99AEBA466A58FA68554B29440B2CED77F8CBA2621405F688806808F6F69A13B1AB9B2924E0B2A843D792E957BC9C0796B515588EB39D1F3D0A92EC781E7FA09
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...0...0...1.0.1.0...............................................H................................................................3.6.0.c.a.l.a.I.n.t...d.a.t......................................................................................................9(....~E..(sP.a.Wj.x=..&....<....$.....)..L]....8.......q.k.E'p6..O.L..BB.\.a..A.Z.......]...@g.*.VM.....J.~.1.n.Sz#.d......#.Xw%.Xw.`...04...8.......2......04...2.......8....18\DE_.~*....n~............../".....%...e...[.I.^?..z..t.........rw.6UW..4...((....V.6.;I."t...G...X=.P@..b..-j..../}...M... .. ?7..y.X.u....I...P ..pXC.)lG..4.C.2....q&NnM.......mJ..E.~~...Wl.g.;...$.O/.8.[v.r8.iG.9......."..S...h.#.3w....w-...J@.Ai.t.f/.0.."C2QR....../5.x...).....C....=.....k/.x.Vx85..@........U.w...,...4..F...;..4...x..y...{?D..};..c.....7...}.^"...@.........c.y..$gAR...}.F."...P.:..A.....e...TM.[....3..+("t.jJ....._,.v!.f?.`..[!.&.4.u.&#.A.@zu6KH.d...LR.8..........q.=A..=k.-Z.GI.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360calaInt.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):495168
                                                                                                                                                                                                                          Entropy (8bit):5.46500001314308
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:+3E8a+2egMKd6kshUJ597fwQ8KSwxggggMCUsP1eJNqCkfhTwMQ9i:9MKkksyAKPggggMCUsPOqzfyn9i
                                                                                                                                                                                                                          MD5:81154B23D57FC0FA594331141F463CEB
                                                                                                                                                                                                                          SHA1:37E095C716FCC01BFA00964719181A75110B31FD
                                                                                                                                                                                                                          SHA-256:495D23A0A624D1681A3B897E98C5CB2EE5A93B09FA629B10481A3FAEB481D861
                                                                                                                                                                                                                          SHA-512:A63128D2E9E55F0B5081402E88CA7C60AF9C188A76636153E9AE0E72C7B3BD805B962788B554302F0905B27F2DE9321C56D6A8DD2893A57F77AE7895157DCF1A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........l~............S.....-c......e......e............-c.....u.....)d...../......+d.....+d......e.....u.....u.............d......d......d............d.....Rich............................PE..L...u ._...........!.........z............................................................@.............................h...H........p..H............V...7...........j..p....................k......0k..@............................................text...`........................... ..`.rdata..............................@..@.data...............................@....rsrc...H....p......................@..@.reloc...........0...$..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360compro.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):613728
                                                                                                                                                                                                                          Entropy (8bit):6.685958524264304
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:q6lIf2CegjegIUaEJve0VLOXlg7crPwnjUZGX1WevvpBwE1We:wjeGvvdcrojUZM1Jvow
                                                                                                                                                                                                                          MD5:BD196C9E32F504A49E87507A9B816534
                                                                                                                                                                                                                          SHA1:85612512BC8D4CDA811C2BF9CF76A5E2F417345C
                                                                                                                                                                                                                          SHA-256:4DEB7CB3FC824674A9191AB7E5D871B70A8B9BF08FB867BC2FA09E62DCF33735
                                                                                                                                                                                                                          SHA-512:B54F9475398D6B38F011B4FAA667E009CB331A26D33517EEC02AE6F2869B679708AAFA49DE49698CC06523C8BAEF3DA38384B28AEE556FDC8E1BE9E59AE8AFD3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{..E?...?...?...6.y.2.....f.>...6.e.)...!.t.:...6.c.....?.......6.s.....6.t.A...6.b.>...!.d.>...6.a.>...Rich?...........PE..L......]...........!.........h.......S..............................................k.....@.............................B.......,.......t\...........(...4.......X.....................................@............................................text............................... ..`.rdata...H.......J..................@..@.data........ ...@..................@....rsrc...t\.......^...H..............@..@.reloc..l...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75560
                                                                                                                                                                                                                          Entropy (8bit):6.799732424154708
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:SL/MfxpOpEIrspt/OX0iNvCvhaMhD1KvLf0/hC00MPUMaGdJbNgowoB5aAk1S9gp:SL/MfzkwI0sRpl1S9x5eMM
                                                                                                                                                                                                                          MD5:C5D3996B9C09D69BF170FDDDA270C0F1
                                                                                                                                                                                                                          SHA1:E8AB2D1DEE6993363F40A654157309FF622A066C
                                                                                                                                                                                                                          SHA-256:944EF806FA2E933870218FD98694E64CBD01611972453C7B4A283606F9503E2C
                                                                                                                                                                                                                          SHA-512:C26178C4988403EFAC6805775CAEA52088BA4F276821768B6809113BC002E2B1B6225943F2629937B3702F6CAE597562A0D48667F2A1C1CACBE3FD0A5A8357EF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$..........m...G.v..v.....g.g....P."l.C.+<3......FTKDK....fJ.x.....a...2]..]N]M...+..H..Bp...]....+ht..<.u.....:.QV...m._.......z.X.\.Gia.d......................................................................................................................................................................................................................................................c.u'..&'..&'..&'..&...&..D& ..&..B&#..&..T&<..&..E&&..&..C&&..&..F&&..&Rich'..&................PE..L....Gia.....................B...............................................P......>...................................Y.......P....0..x................J...@......0...................................@...............(............................text...r........................... ..h.rdata..............................@..H.data...X%..........................@...PAGE....f...............

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc64.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):84264
                                                                                                                                                                                                                          Entropy (8bit):6.597850870118274
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:9Y/b7GDfCEBFnynVyQKjbEUB92tGtt2ApZr9gV3oseMob:9Y2jrPygQKjbE62tGtt2Q99KBeMw
                                                                                                                                                                                                                          MD5:43E4F438FD80354687923AADDDBCDBEE
                                                                                                                                                                                                                          SHA1:C7E4BFAD708CFFC86D88910E4161BA0FA76A3419
                                                                                                                                                                                                                          SHA-256:798BC37C3807ACE8FCE07E5FD24EF732F38EBA373EB9BA6BD8D026D326FD0A51
                                                                                                                                                                                                                          SHA-512:12EF24257A6D3DEC6D94949DF6FBC7A1919FF11D8D91364D77994CFFF6E9EFBE6E2EFCFA4D0EF09DF21FFE6AA877AA7F03EC810D1984486EB17CF4585DCD610B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$...........................................................................................................................................................................................................................................................................................................................................................................................................x...x...x.......x...y.1.x.....x.....x.......x.....x.....x.....x.....x.Rich..x.................PE..d....Gia.........."..........F......<C...............................................................................................0..X...xC..<....`...................J...p..P....................................................................................text............................... ..h.rdata..............................@..H.data....'......................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc64_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):92896
                                                                                                                                                                                                                          Entropy (8bit):6.724310605201575
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:9C/b7GDfCEBFnynVyQKjbEUB92tGtt2ApZb9gSz/xe3oseMob:9C2jrPygQKjbE62tGtt2Qt9wBeMw
                                                                                                                                                                                                                          MD5:0D4AA9A56F354A8A41C5C8E9829B72B4
                                                                                                                                                                                                                          SHA1:5FC2536AE29D7C2A5E00402AA1B496D55BBDC69D
                                                                                                                                                                                                                          SHA-256:191EF546D4B2E8A90C9FD41CBEB3764EE98BDF07DB8232AC8C3081BC030C7953
                                                                                                                                                                                                                          SHA-512:A6058DF571D4D625FC31E20D872E724875F707A75F89A73DF9913D71D46B9AEAA58BDF4776173AD2EE1CBFE7A8D141F5C59B6BEDDF0C715A6E89953B281743AC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$...........................................................................................................................................................................................................................................................................................................................................................................................................x...x...x.......x...y.1.x.....x.....x.......x.....x.....x.....x.....x.Rich..x.................PE..d....Gia.........."..........F......<C...............................................0...............................................0..X...xC..<....`..................Hl...p..P....................................................................................text............................... ..h.rdata..............................@..H.data....'......................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360disproc_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):84208
                                                                                                                                                                                                                          Entropy (8bit):6.911786870195721
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:YL/MfxpOpEIrspt/OX0iNvCvhaMhD1KvLf0/hC00MPUMaGdJbNgowoB5aAk1b9gl:YL/MfzkwI0sRpl1b9AW5eME
                                                                                                                                                                                                                          MD5:4F52319CB75BD98B9C1D7186EB9413BC
                                                                                                                                                                                                                          SHA1:207B0BE009E9A0BCBB80F0D147597A19D089A341
                                                                                                                                                                                                                          SHA-256:8352D261171BE837672E79A6FE313B8666F714D5FBFBDBD234F725A58FF4EC84
                                                                                                                                                                                                                          SHA-512:205FB42734AAF2A8CB372F1039EB0A4AC5025CBA88F5358A3970126DC03FE5960909C4518330DD8DE589CA511C191CDC4E6119393ED4C6F6FA4DE6107A837E89
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$..........m...G.v..v.....g.g....P."l.C.+<3......FTKDK....fJ.x.....a...2]..]N]M...+..H..Bp...]....+ht..<.u.....:.QV...m._.......z.X.\.Gia.d......................................................................................................................................................................................................................................................c.u'..&'..&'..&'..&...&..D& ..&..B&#..&..T&<..&..E&&..&..C&&..&..F&&..&Rich'..&................PE..L....Gia.....................B...............................................P.......4..................................Y.......P....0..x...............Xl...@......0...................................@...............(............................text...r........................... ..h.rdata..............................@..H.data...X%..........................@...PAGE....f...............

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360drwht.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42856
                                                                                                                                                                                                                          Entropy (8bit):1.758297042080694
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:kyf89t5+mn0olvxxpFPC2BLuhbb4kzMtPNguTI7N11j5i1D6SI:d8/5nTplCe6bH4ZNFCN1t5i1bI
                                                                                                                                                                                                                          MD5:0537BF26EB498FDAA065C094F30142BE
                                                                                                                                                                                                                          SHA1:94B099484F232310363ABAE63D2390F4308F23C6
                                                                                                                                                                                                                          SHA-256:1F2EC7012D74910267F23F0072F31CB90AB2B5D55237EC511040B40AE5A0FAB8
                                                                                                                                                                                                                          SHA-512:82E69BB652D29DDDBC685DC177F2F17D37575E0BBBF4FA3E62CD32E67C6DC5428B9F02A497DE81E6C5D5BB9214D4B603C6E584E6E3E54B533B5ACD09E359C847
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:D063<...............,.....3O.....................................X.....................NO...n.J....?............................................................................................................@B"~X..A.....I.............................................................................................................GVBj..G.w.?yvJ.............................................................................................................p{.....f..B...L...............................................................................................................o..:..~.!.._O............................................................................................................q....&,Y.H.....u............................................................................................................1,.:^a..f6V...}.............................................................................................................1/*..-..q..q./,.................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360hipsPopWnd.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):809376
                                                                                                                                                                                                                          Entropy (8bit):6.488520183728409
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:GjoFZpzy3B1YcrPk+8BZk1t+v6T+6jyKj9h:cDx9xWm1tkwyW
                                                                                                                                                                                                                          MD5:C77481CAC4C9411AA1EAD1DE68C7798D
                                                                                                                                                                                                                          SHA1:F2288AF2EE58E25DE2A11DA09589BB61E94AE5CB
                                                                                                                                                                                                                          SHA-256:EB04CC2139F21F62107AFAF03939C49515730CCE4ED0F0E6D12199445B5F377A
                                                                                                                                                                                                                          SHA-512:BBDE3700933D5264EC024F866DC1C6B5D7E51D6368F3614AA95FBBE93FB9EE593E87F61E7F945D141D883D4D2A07C22114BB98E262F2AFBCCC7EC485CFFDE3CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........ns..ns..ns.8!.ns....ns..<...ns......ns.....Ans......ns......ns......ns..nr.sos......ns....ns..<.ns....ns.Rich.ns.................PE..L......c...........!.....................................................................@..........................\..s....A...........................I.......p.....................................@............................................text....~.......................... ..`.rdata..c...........................@..@.data........`...<...T..............@....rsrc...............................@..@.reloc..v............j..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360procmon.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):481344
                                                                                                                                                                                                                          Entropy (8bit):6.380886151778804
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:ZoOB3xht8if82B4gnYmk5WznakAQC9CWp1VfcrZg5cC+5XlSPbgS9mG:LZxht8s82vYCAQIV1VfcrZg0HS9mG
                                                                                                                                                                                                                          MD5:83F8ED9DE87847A744D5C9886497C35A
                                                                                                                                                                                                                          SHA1:EBD215EC6EFF04B395F4DDFFA77B5F06D43D2E74
                                                                                                                                                                                                                          SHA-256:0F9B89A1D321941FE5C9E714AA4590DACF6E88F4014C2AE69E394CB4F3E5640B
                                                                                                                                                                                                                          SHA-512:C110AA4504E6978F365FDCBBC933FCF6BE9B8B74403E4901B3801658BD8B540C830A3A579A7EAB3865CC5C12E3545E807D3257D4EF36BE00E6DA5077B8F5C4E1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................R......M......\.......[.k.....K..............\.....J.......L.......I.....Rich............PE..L...F0._...........!.....j...........0...............................................z....@..........................].......H...........a........... ...7...@...8..@...................................@............................................text....h.......j.................. ..`.rdata...............n..............@..@.data....n...`..."...N..............@....rsrc....a.......b...p..............@..@.reloc..nK...@...L..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360realpro.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):343392
                                                                                                                                                                                                                          Entropy (8bit):6.428989711129984
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:54vxgH018gU1QqxiHpb9LEALu/Rs/u6X5PbKiK:54vCdF6pb9Di/CV2T
                                                                                                                                                                                                                          MD5:E0A6DC4B6AE59A1A174EE1E423B9E567
                                                                                                                                                                                                                          SHA1:479505FEBE2051521D5FF419AB786F29F2A489BF
                                                                                                                                                                                                                          SHA-256:81F9A196A03B727FDAE2282CC2A74130E53FBE3D2FE254B77DDFED3B7834596F
                                                                                                                                                                                                                          SHA-512:485AC5576D95EF9B2B800BF22800F43A41C5A0A7BAC754EE9DA0E18F128733F4635C693F96DB92689F7CE24AFC695800E9EDADCED8DBBCC9E7BB6785206AB528
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!.d.@x7.@x7.@x7...7.@x75..7.@x7.8.7.@x7.8.71@x7.8.7.@x7...7.@x7...7.@x7.@y7.Ax7.8.7.@x7...7.@x7.8.7.@x7Rich.@x7........................PE..L...>..].................2...................P....@.................................b,....@.................................`........`...................4...0...)...S..................................@............P...............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data....n......."..................@....rsrc........`......................@..@.reloc...K...0...L..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360safemonpro.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1887464
                                                                                                                                                                                                                          Entropy (8bit):6.594690555634628
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:1lh82MRazG7em1CfDQkTHQBwJ4T333SUoB2n:1lo2mOTHzQSUoi
                                                                                                                                                                                                                          MD5:DD71B2EFCF4DF3EC15D2631CCCF9865E
                                                                                                                                                                                                                          SHA1:20C571BCA718C6BC4ABD5B2CC016D2BBAFF8811D
                                                                                                                                                                                                                          SHA-256:63D925AC60E24E47DB65563304EE591D9986C60BBB74E29F4C83E7AB116FB69F
                                                                                                                                                                                                                          SHA-512:147C55DB28583CA47A924986ECCC7DB0E35D9982E140930830EBC50DBE9EC184008604793F52A846E78977333034B71FF3B42AC2C81B67E2675E64C7C22F5E0C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........KV.O*8.O*8.O*8..e..H*8.FR..k*8.Qx..J*8.FR..P*8.h.U.J*8.h.C.l*8.O*9..+8.FR..*8.FR..J+8.FR..N*8.Qx..N*8.FR..N*8.RichO*8.........PE..L...'.e...........!.....$...v...............@......................................?=....@.................................@}..T.......P...............P,......$....G.............................. "..@............@..l............................text... ".......$.................. ..`.rdata...c...@...d...(..............@..@.data....B..........................@....rsrc...P............2..............@..@.reloc...`.......b...<..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360scovec.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):964664
                                                                                                                                                                                                                          Entropy (8bit):6.804788145186968
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:+SChyYDO1JRzY6YVHpyUX0guKA54ZmXUXx9MdtTxrd9:+SCYtRYVHpyUNASnh9MdtTd
                                                                                                                                                                                                                          MD5:550DA9197B7C931882819D78790D57E0
                                                                                                                                                                                                                          SHA1:42D325F8EEA6FAA441D347D469ED65CF456504DE
                                                                                                                                                                                                                          SHA-256:EB0B967EB095CBA1242EC31EEAAA662551027C461A81EA3D765F6BD95B60CC67
                                                                                                                                                                                                                          SHA-512:2E51F8976DF6B0C76C996C8DF6620B1CAAD03EE904DE83A7EBF7E6CA3B62272B629AB9BC7F9603C6A82312048FCFD27A3888C7ED509DCB91BD99611CFB649A99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......Z..3.O.`.O.`.O.`..#`7O.`..!`.O.`.. `;O.`...`.O.`L'.a.O.`.O.`.O.`.&.aKO.`.&.a.O.`L'.a"O.`L'.a<O.`.7Q`.O.`.7A`.O.`.O.`.O.`.&.a3O.`.&.a.O.`.&-`.O.`.OE`.O.`.&.a.O.`Rich.O.`........................PE..L....,.^...........!.....h...........E...............................................k....@.........................0...\............`...............|...;...p...u..@o..p............................o..@............................................text....f.......h.................. ..`.rdata..TU.......V...l..............@..@.data...TO.......(..................@....detourc.....0......................@..@.detourd.....P......................@....rsrc........`......................@..@.reloc...u...p...v..................@..B........................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360scovec64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1141304
                                                                                                                                                                                                                          Entropy (8bit):6.503235309371252
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:ydLT/dI2K1AKPRwr6b/IP/Ke5hsLO9Y36Z0D2VAvC94f3GZNwdddme/qLp3DBQmG:ydLT/dI2K1AKJwr6b/I3Kej4fbYTLppW
                                                                                                                                                                                                                          MD5:38E0D360F363D5265D9B1CE48FA4CBEC
                                                                                                                                                                                                                          SHA1:A38EC88BCB8202CBC30D15DFD24187AC230D44A6
                                                                                                                                                                                                                          SHA-256:3097CCC783D5FE2AF87FB24A49D614C251FB708CC5F45A9F486ADB67A92B5759
                                                                                                                                                                                                                          SHA-512:7133C395996C39FC0E1FFC75241FF5219556F12FE59F96002C5A9CBD643D3FFE4969C29AA10E5B9089A6E9B1897E5AA27C2F6FBD14FEF2C3C28E7B27B90756B3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......t...0...0...0.....h.%.....j.....k......*^.1...b.9...0...1.....e.....3...b.p...b.....9...2...9...)...0...7.....1...........1.....f.1...0...1.....1...Rich0...................PE..d....*.^.........." .................[....................................................`.............................................`...`............................;......@....(..p....................*..(....)..................@............................text............................... ..`.rdata..X4.......6..................@..@.data....r...@...:..................@....pdata...............V..............@..@.detourc."...P...$..................@..@.detourd............................@....rsrc...............................@..@.reloc..@...........................@..B................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360uac.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15129
                                                                                                                                                                                                                          Entropy (8bit):7.217061498117631
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:9wzLKFRYVw2lSH63lHPdBWHNOSJkGpAeiK+0+wRygoY4nwX+tUZZMJiZbwB3N0w0:9wzQRX2oaVPb3KHXZZbwrATdPsZL2qA
                                                                                                                                                                                                                          MD5:D312DB6319598852379DA7AFB426958B
                                                                                                                                                                                                                          SHA1:2AC678FD93633DDAB28FEA4AAFC74261A33050A1
                                                                                                                                                                                                                          SHA-256:911AA9455E82703EFD159A9305F0E852178FEB59E57892EFAD5706B6A4630973
                                                                                                                                                                                                                          SHA-512:6AB47EBBF1495B5F10D5EED3F63EB98D976D1978DFC1C344A8558A10E175D4BA60B22A0FBB9C73BE2E3A08D7AF2492BE6D962A909BBCE9DCB88D42FF56F37E24
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:360G%1.............*....................:...>...-...H...}...5...c...>..._...v...n...~...5...c......v......./&.."w..Zh}.K,'.#|..U..U.....Y...n.z.k...m...V(.u..;.C.......2....|.".'A.......:q.o.@..Fm...5d...n.tvB....o../.d7k~a.....OX.3K....7..n2........e..}8.b.;5..j.....|.x....-O}....u;..O;Sv'.$..L....q..Ki..X}6..r.S..B..2....)iSW.....<...?...,...I...|...4...b...?...J...u...u...n...v................/'.."v..Zi}.K-'.#}..U..U.....X...o.z.j...m...V(.t..;.C.......2....}.".&A.......:p.o.A..Gm...5d...n.uvB....o../.e7k~`.....OY.3K....7..n2........e..|8.b.;5..j.....|.x....-N}....u;..O;Rv'.%..M....q..Ki..X}6..r.R..B~.2....)hSW.....>...<.../...J.......7...a...<...H...J.......T...p...7...a........../$.."u..Zj}.K.'.#~..U..U.....[...l.z.i...m...V(.w..;.C.......2....~.".%A.......:s.o.B..Dm...5d..n.vvB....o../.f7k~c.....OZ.3K....7..n2........e...8.b.;5..j.....|.x....-M}....u;..O;Qv'.&..N....q..Ki..X}6..r.Q..B}.2....)kSW.....<...=.......K...~...6...`...=...M..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\360zipc.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):644720
                                                                                                                                                                                                                          Entropy (8bit):6.453497479013619
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:oFEX5YD8xMSJPPcNg1oevUzjtvA8hToBPaXsZO7olLIH/BeBOcgMeXwmptnz:oFEM8Pv8vtvA8hToBPc79fBeBOcgDHjz
                                                                                                                                                                                                                          MD5:CF1766748B6C8EC921ED1137B0550683
                                                                                                                                                                                                                          SHA1:4E4E9386F273A10524A2F80E8FF91922CC014B27
                                                                                                                                                                                                                          SHA-256:554B214DA25A16EA3242DD410EF5A59255481DBBD1826B86712019FA6ACC3A56
                                                                                                                                                                                                                          SHA-512:DA386129CEC970B12F38A9C4CF2074F686592DE1C291B29CFA1FE28F237F2A6A6EC3363012965EAD02DE911BFB7A8936F0E9A5B55D69FCA3F00ED19C6481C732
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@Ax#. .p. .p. .p.o.p. .p.X.p. .p.X.p. .p2..p. .p#.{p. .p#.mp. .p. .p. .p.X.p. .p.X.ph .p.X.p. .p.r.p. .p.X.p. .pRich. .p........................PE..L.....oV...........!........................0......................................(g....@......................... G..h...d4.......`..H....................p..xS...3...............................................0..T............................text............................... ..`.rdata.......0......................@..@.data........P...,...2..............@....rsrc...H....`.......^..............@..@.reloc...U...p...V...h..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\7z.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1495104
                                                                                                                                                                                                                          Entropy (8bit):6.723714746270069
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:oNZ1kr6C8POFAJtZ76vbQDHhlFhdT0P0iPcnfjY0WPcYlPElIZpnkGljQQji92gw:oVr2qZ76vbOVhdTliUn80ccuMlI7/lJH
                                                                                                                                                                                                                          MD5:EED3C31E622596028240EDC1687C88CC
                                                                                                                                                                                                                          SHA1:314C30DB64D4CCFD63A00A75716A10607E2E09EE
                                                                                                                                                                                                                          SHA-256:FAA5A6F21F0819D83FE17FBE23D7211E8203D61AC26FD90086052B0D30D928A0
                                                                                                                                                                                                                          SHA-512:B52DEC4222F5ACCA72E0B26BCB38B95EEDAAEFF2374C438F4D95F82ECF77BE2709DD068F85C6F699283FC4E3455D5C718C4A68CFEDE76523A52F212CA8F1A88B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................d.....g..................v...q.,...v.....`.....f.....c....Rich...........PE..L....[^...........!.....F...L...............`...............................p............@..................................r..x........................7...........d...............................u..@............`.. ............................text....E.......F.................. ..`.rdata...%...`...&...J..............@..@.data............F...p..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\AdPopBlocker.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):549440
                                                                                                                                                                                                                          Entropy (8bit):6.44621405725735
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:osPSKq4TG/ldHx2V5BVot01uU8+1rNys+vm+qIEVCfK41rQmplNff:MfxurNyvVrXplNH
                                                                                                                                                                                                                          MD5:D00F529859BBFB17A7A82FD02D22D932
                                                                                                                                                                                                                          SHA1:4B2876BE0FACE18C40FE41CA195A79B9E75217E0
                                                                                                                                                                                                                          SHA-256:47F38E49CAEE983B886BAD9A3E3E91160CB79A71BCAE3F841EE309A42CB58370
                                                                                                                                                                                                                          SHA-512:E5E6D0CC0AA6D0B35A31D46C7A41D262459A3A39B76C9B7AE229219CB80826783CE46978D12F36FE43425970852B44CAA74A58474956E13AC4D126EE33DFD23C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........;...;...;.... ..:....R.9...%.@.>.... ..3...2.Q.&...2.G....2.@..... ......;.......2.N.....2.V.:...%.P.:...2.U.:...Rich;...................PE..L...LR.\...........!.........................0......................................Rk....@.........................`?..T............................*...7.......O...8.................................@............0..t............................text...|........................... ..`.rdata.......0......................@..@.data........@...6..................@....rsrc................d..............@..@.reloc.."............l..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\AntiTrack.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3008
                                                                                                                                                                                                                          Entropy (8bit):7.695564479187755
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:MldwEXA7/W6MtbiBbOfSPUJmO18ZODJPj85hTxlT7vLFVE:UVX/6YhaimOmZOD9jonl/E
                                                                                                                                                                                                                          MD5:1CDD0F17CBAED71D7E76BC111B19B7CA
                                                                                                                                                                                                                          SHA1:A5E6CFAC37CAC24F7610B14392F8E61AD657AC36
                                                                                                                                                                                                                          SHA-256:23ABAA336E8EED4465E630AD486CF5076D29DFEB936EFEA6369CF758D7721C30
                                                                                                                                                                                                                          SHA-512:5D704246376A51D3544A330EDCAAB853486E0D90F8C0A4E05ABDC5BD829DC45E2A3D63D0AFBECD01F2873EC28258B389708D0E1F0899347C5E7F6B3836390CD7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..o.hr..FO.'f\}S+.X].!{.8......F..YUP+N..W....>.|}.Vlm>.Nk..?H...%dk.....3L......Q........&/X.0)T...7Z.[!..........:.A...u...x......".....D..5.w.M.w.W.UX.j.3Fu..9...&.1.w.t......-SV.u...xtl._@jV9.D.....n".-.W&..)..#......>.ih..8..O:.._ ./nTKF...5<.x.H.07.}Nu."........*...1....QQ3.@v....v..)..../X.0)T......5Z.....Q..0k,/`...o.[.c......B|..S.......n...BnE8.fA.C.\.#3.r..\O.5.60.:.......b9..Uj..O..Y...Q.bGf....t..|aD..S..[WU{.....f.r.}?....1..B.-_.h.....H..K.A..K].v.as..N6F.....".bD.G..6J.... ....p.....,.4-u&.w...l..V..a.....]Lk...R@oT..?...'._....p.lBq.....*..%.S..H../....@.M.k{..F.n_.p.lBq...d.. ............ ..u.7C-1A.f......M..~ ...p.lBq..A]J_7..H.3..zO|..?.......N...J&.n./!...~..._.g......`R...:$...p.lBq...p.lBq..>2.g3.A......... ..u.7C-1A.f........{.../.J......p.lBq..."b5.....j.."j.p.lBq..A]J_7...W.......VO3....b..N....R}..n@8^...0...2c.p.lBq...p.lBq..H..Q.?..F....F....../..h.L......Gj.....I....u(.....,.N5..p.lBq...p.lBq..C...@?q

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\BootLeakFixer.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):420192
                                                                                                                                                                                                                          Entropy (8bit):6.756369677924066
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:g49CUYaPQ805c8GU+08ZPkiNP3TJbyOFSCR3c1PSQ8BMsP0Oumh+h8vAmbrzDXd:gmC7a0uuEpNPDdyuBMsPihFm3zDN
                                                                                                                                                                                                                          MD5:5CF559F92C327AD22772D673898F7394
                                                                                                                                                                                                                          SHA1:83F12FBCC170E03D2EA159EBE02DEA17FCCCF935
                                                                                                                                                                                                                          SHA-256:08B8229FFC49E416B37280A9BFC64F7A97FE0BE634632438E461E29CF5BFD690
                                                                                                                                                                                                                          SHA-512:613F2C4C1E2B74EDBA273F86AB47D7469378B7964D7123EC1446A5419FA3C59B5F6004953D49B85C5E88852556C9589C6080B93BE319FCAD73D7C970F3175CBE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........b............k......k.....e.....bj.....{Q.....n......n.....d......mj.....bj......d......d.....bj......e......e...........k.....mj.....`j.....`j....`j;......S....`j....Rich...........PE..L....b.]...........!.........V......p...............................................u.....@.................................$...P....P.. ............4...4...`...+......p..............................@...............4...4... ....................text............................... ..`.rdata..v...........................@..@.data....6..........................@....rsrc... ....P......................@..@.reloc...+...`...,..................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\DiagScanTips.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):389480
                                                                                                                                                                                                                          Entropy (8bit):6.58464972770025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:P7P9814Ekoodei5FBQ8QNvB1JCea+lmGy6ls0dk4HGCcCWkUcu+lyxLdq19gcHni:h+kZJQNvB1Aslty6Jk4HGCcCQ1sP9DeK
                                                                                                                                                                                                                          MD5:13F814762509265C6A932EC0DB47224C
                                                                                                                                                                                                                          SHA1:CE49C13F986E55B18AA5F5F008247C8B8042035B
                                                                                                                                                                                                                          SHA-256:87EAB081EA03E8AB44135F4D8435111643E2C2CDE035F7592FF665608B7721F2
                                                                                                                                                                                                                          SHA-512:CB985412825D705154B843BA31C1D549C3B41698F03ED4DA8292A8EAC4C71CD3376AF2ED5D7E4F2585CCE11E2031BE6E2EE49BF14B99FA54BF76D8686C758C49
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........w`...................~......~......p......p............{.....n.............q......q.....................p........0....~..............................................Rich............PE..L....}.]...........!................................................................0.....@..........................U.......V...........................4.......3......p...........................0...@............................................text...7........................... ..`.rdata.............................@..@.data...@8...p...(...X..............@....rsrc...............................@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\DsTpi.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):238592
                                                                                                                                                                                                                          Entropy (8bit):6.566107598782951
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:feVYSIpPbbaiOzWuTkqhnB38HDY2Be2DAFOH99qA1QjRCAYcMRP/3M54ND7RFFJ:fytGc3B3sMc90Od9XGjRecM9h5L
                                                                                                                                                                                                                          MD5:839427C06ED1EA7FB6A2BF1EED742004
                                                                                                                                                                                                                          SHA1:E8411EA2EB0CD205364383EA538586DFEFB2B866
                                                                                                                                                                                                                          SHA-256:13BF112CD67B2BAE307790570B7D93A5B979869AB8CE02062027D90780A79B5E
                                                                                                                                                                                                                          SHA-512:BA5BD2A2E417C33AA4E7A73E76EE4973C1143FEA3F8BA1687A2791B0A1B5F4E66C42E5F046C993843346AE74249ABFE0607DACD0A174AF4A5AD377073DD105A7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j............sg.....sq.S...s{.............n.........sv.....s`.....Yf.....sc....Rich...........PE..L....r.\...........!......................................................................@.........................P'..M............................l..h7.............................................@...............d............................text...I........................... ..`.rdata...w.......x..................@..@.data...|H...0......................@....rsrc...............................@..@.reloc..\5.......6...4..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\EdgeVerLib.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):664
                                                                                                                                                                                                                          Entropy (8bit):5.701085282805744
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:vnMrGUGTzUXHFbacmYr5F2YrHBiHFVur3wlRYMbzrlFhn4BWMaOgbgBAYZgbq64O:/L7c72q8Phn0DAWJU/J/SE6hnY93ln
                                                                                                                                                                                                                          MD5:95C121BE02DD070C624C75FEB60E6FE4
                                                                                                                                                                                                                          SHA1:95523E0C09E5AA61F1F8BF175BB8B0A01EC910D5
                                                                                                                                                                                                                          SHA-256:BD6D9476C6ECF73D18F356AECC644278F9BFA9EBC5210755537D89E047F543C0
                                                                                                                                                                                                                          SHA-512:3B3139910F54137631B32DE0DAA0F140839976985F44EC303FE5FE287D7D44961A0598B24037511CA3642D840CE26637F403FD8EC4C4E3E17915FC810D9A0424
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.?-=`~y|e.EE3!'">-=#4.%&?&:r`~q}\C-+6,!<>.%&?&:r`~q}\CEE.?-=`~.yb.EE3!'">-=#4.%&?&:r`}q.\C-+6,!<>.%&?&:r`}q.\CEE.?-=`q{yc.EE3!'">-=#4.%&?&:r`y|v\C-+6,!<>.%&?&:r`xy.\CEE.?-=`px{`.EE3!'">-=#4.%&?&:rd}~B[,,(4 ; .$!!>;uze.EE\C.94;yv.x.B[+ <&,:=,."0#'=lxpwhyEE3!'">-=#4.%&?&:r`yx.\C-+6,!<>.%.;&:r`qpvaDB*5.-&"&."8''=lxx.aDBB[.>*#x.~b}.7i..B[+ <&,:=,."8''=lx.vcDB*5.-&"&."8''=lx.vcDBB[.>*#x.xgz.7i..B[+ <&,:=,."8''=lx|vaDB*5.-&"&."8''=lx|vaDBB[.>*#xp|g{.7i..B[+ <&,:=,."8''=lxx{hDB*5.-&"&."8''=lxy~aDBB[.>*#xq.ex.7i..B[+ <&,:=,."8''=l||y\C-+6,!<>.%&?&:rd}~B[DB.',:~h.y.)q~.\C*'>$'+$%-.<(" #tywipxB[+ <&,:=,."8''=lxx.aDB*5.-&"&."0#'=lxpwhyEE4-/*8:'.< & #ty.ayEE\CEE

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\FilePrivacy.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):261088
                                                                                                                                                                                                                          Entropy (8bit):6.677514058190806
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:mT2eCPFGhk1grkAxUccBvv06vAOwHchS9CcF9PZ:v16kAxUcYrvvS9Ca9PZ
                                                                                                                                                                                                                          MD5:F924AF1199497FE1B0C08DAB79FF7234
                                                                                                                                                                                                                          SHA1:C654AB264D010B6657860370E3BFF724475D8CA1
                                                                                                                                                                                                                          SHA-256:9C692049C5B5D42A5A34A69E259788336C9E103F7F60B63E9BE1D007C5E93B17
                                                                                                                                                                                                                          SHA-512:F4C00BBEFF436D5D6BCFED1F8B738DC614338BAE78A844F3DFC2A0AEFE18A3493B2057996B6DAC8389CBC5AACF24516BF4F5821585AB48C2B12D559943528285
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I...'...'...'.]O....'.]O...'.]O....'..#...'..$...'.."...'.....'.....'...&.s.'.L.....'.L.'...'.L.....'......'.L.%...'.Rich..'.................PE..L...<..a...........!........."............................................................@..........................~.................L...............H?.......!...\..p........................... ]..@...............<............................text.............................. ..`.rdata..p...........................@..@.data....&...........v..............@....rsrc...L...........................@..@.reloc...!......."..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\PopWndLog.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1565760
                                                                                                                                                                                                                          Entropy (8bit):6.434098230710548
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:roJYU1gkAUv2pE5jbhjjMxuReQnNBj1lFTMRNbIKydHTW9q1vgf99:r6gkAhE5PdjzReQtLM0KydHTCq1vg7
                                                                                                                                                                                                                          MD5:752CD411438B1F94F485662749754316
                                                                                                                                                                                                                          SHA1:BA26C80A94BAC5966DAF5B766C825099D953AB05
                                                                                                                                                                                                                          SHA-256:1F5C6218EA6235B851E8C10354E7D2A8FEACC62C21C655832DFECF92575036B1
                                                                                                                                                                                                                          SHA-512:B7AFDEA7947C4F96D4159C1BA7A09F17F7DE8764CB5549F92686526FB0D2983CC309254AAD82ADEA331535C1BF55089241E35CCB2E4EBFE2BFE53B6DE9479878
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1}.}1...1.~1...1.o1...1...1...1.a1...1...1...1...1...1...1...1.h1v..1.o1...1..1...1.z1...1Rich...1........PE..L.....`............................|.............@.......................... ......sG....@.................................,D..h....@...................7...`.....@............................... ;..@............................................text...\........................... ..`.rdata...t.......v..................@..@.data............r...f..............@....rsrc........@......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\PopWndTracker.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1634368
                                                                                                                                                                                                                          Entropy (8bit):6.423253707126576
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:oUolrU/JboM0lOglm2nNPYs/9Wuy5gCkIurDsD7eXGzLervxqA9b:Kl4/BvOFm2nhL/9lyGDsD7SGzLezUG
                                                                                                                                                                                                                          MD5:45003027576F06537D64CC11FE118049
                                                                                                                                                                                                                          SHA1:5829E85F27CC493136EA13845462AB19414044EA
                                                                                                                                                                                                                          SHA-256:C8A1EC1B919F9E760A1A434E4C8E3DB33F8C541739C94860132902A509DD0F6A
                                                                                                                                                                                                                          SHA-512:05A41310C4B2635106BDDFA7D5E80C521EFA83A92EE2F329AA364D405BA300CC459D6B3305043CEDBF2DCACE30402A25A1581C9A8C5560691A6C29F765665E6C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O....................)a'......V$......V2.%....|5......V;........................,...V5......|%......V .....Rich............................PE..L......`............................[J............@..........................@...........@.................................D#..@.... ...Y...............7..........................................`#..@............................................text............................... ..`.rdata..h...........................@..@.data...p....`...b...B..............@....rsrc....Y... ...Z..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHActiveDefense.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1102080
                                                                                                                                                                                                                          Entropy (8bit):6.558059688248605
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:8uh3MZ1z5SmBJ5cIlzAaUPGwXGnBvCELsEbtAY/vwlrmxe4dQ2phzLXqphrYMJdL:l35JJNewjUMJdUT1EefQNFf
                                                                                                                                                                                                                          MD5:7E0BCE805D94DB8B88971A0FE03EC52E
                                                                                                                                                                                                                          SHA1:F4CE366ED9958D1F25426E5914B6806AA9790A33
                                                                                                                                                                                                                          SHA-256:E4C4FCF88132C1970CCB9EC8F43DC7D1EE193AD552CCDEF8AB166959A25696C2
                                                                                                                                                                                                                          SHA-512:D631B6D22B057FC6F385A701EB9C8895FD59D692FBF14F6F87242837B1C9DF745493FE35ADEBEEE4C2099AC544800F9FD205D4E76DD2BBD85B601DE80854908B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......BN.5./.f./.f./.fuM.g./.f.`Cf./.f.W@f./.f.}Qf./.f.WVf./.f.WQf\/.f!.f./.f!.f!/.f./.f...f.W_fJ/.f.}Af./.f.WDf./.fRich./.f................PE..L.....f`............................vw............@.......................... ......;.....@..................................e..h....p..\...............hB... ..............................0.......0..@...............4............................text............................... ..`.rdata..............................@..@.data............d...x..............@....tls.........`......................@....rsrc...\....p......................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHSafeTray.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1987040
                                                                                                                                                                                                                          Entropy (8bit):6.60171722956995
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:rXnOdpzoVKh8CL3fo1yv0B/GR1bir3kHPBcbq1i:bnO/Bh8CI/GDmDF
                                                                                                                                                                                                                          MD5:6E22F0C643F6BB1FB33D2DFA1C3F15BD
                                                                                                                                                                                                                          SHA1:823F089329BF2BC0EEBA9FF4874251373DC9F399
                                                                                                                                                                                                                          SHA-256:10CD48472480DB182A02D27B9042CCC98E72C01CAE565C9DF1CC2B674FDDCD5F
                                                                                                                                                                                                                          SHA-512:8D02F6F31D4CBBEF62B1AE6D3F8819C2153E90E73840478E5384EC4D8B2C231CEB3A83A4F7A7E52D7ECA6525FFC5BDBF80FD8B1CDDC07FF03F911B885F09B65C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q.....D...D...Dq__D...D.h\D...D.BMD...D..D...D.hJD,..D.hMD...D..D...D..D...D...Dy..D.hCDk..D.B]D...D.hXD...DRich...D........PE..L...&8.f.................:...................P....@.................................n.....@..........................................p..4............(..H)......p+..`_..............................8...@............P...............................text....8.......:.................. ..`.rdata..N....P.......>..............@..@.data........@......................@....tls.........`......................@....rsrc...4....p......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHToasts.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):286632
                                                                                                                                                                                                                          Entropy (8bit):6.510243114159276
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:P5R8snAWBti0jRvgmPzhhVMRZEnY4F+i8YEIpEVzFEsMAl+Js3LBYKPiFQnp:P5R8sAWC0j59zzh00AbiF6
                                                                                                                                                                                                                          MD5:B71FE77BA3D0937F7A6B09C30F5770FF
                                                                                                                                                                                                                          SHA1:FAE29D450D1583ED1F688F2190BFF37CBA395AD4
                                                                                                                                                                                                                          SHA-256:D3E92CCB3D89C6402F7F4069ECB9F79198B126787ABD1BCA7C321D0AD8D8F400
                                                                                                                                                                                                                          SHA-512:631E7C0A9A9AA8C8343373AC349AC145FF48BBB798100A769C49C0EF64F574E1C5C69B390FA472DC5F576C63D0B4C5FFD525BE5DCBFB6D8F816B62C54B5FB6DC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.'.r{IVr{IVr{IV...V`{IV...V.{IV...VL{IV...Vp{IV...Vp{IV...Vj{IV{..Vw{IVr{HV.{IV..Vk{IV..Vs{IVr{.Vs{IV..Vs{IVRichr{IV........PE..L....i W.................4...........).......P....@.................................X.....@..........................................p...............*...5... ...$...R..8...............................@............P..|............................text...*3.......4.................. ..`.rdata..F....P.......8..............@..@.data...<S.......(..................@....rsrc........p......................@..@.reloc..^`... ...b..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\QHWatchdog.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):177664
                                                                                                                                                                                                                          Entropy (8bit):6.809481162174068
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:1H50cLgcmLDaSaCBLBB5OsA3ivrQgpEsMAl+5xuKjZo2bIlN5+FzE:1Z0cLgcmLuS9FwplLAX2cp5
                                                                                                                                                                                                                          MD5:5E6C05D3F8A06F263E1D53FC5C2C53B2
                                                                                                                                                                                                                          SHA1:D957050DFC3AED8F22D9ACE3A5D22192F8527513
                                                                                                                                                                                                                          SHA-256:DE9D09F0E26CB4541F5D6788AEE22183C6A380A1460F0955171316BBCAC5DCB7
                                                                                                                                                                                                                          SHA-512:F3D7F18695DFC24C554443970DEDD6AE366DEE901241A3EC17FA85F1D00E4459A11802E40E263A4A078974B92652EF2897D2AD2B7EDD9C3A08E9954AD24F597B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7.S*s.=ys.=ys.=ym..yw.=yz..yd.=yz..y..=yz..y;.=yT.Pyr.=yT.Fyh.=ys.<y..=yz..yi.=ym..yr.=yz..yr.=yRichs.=y........PE..L......\.................B...6.......G.......`....@.......................................@.................................,...d....................~..h7..........@b..................................@............`...............................text....@.......B.................. ..`.rdata...B...`...D...F..............@..@.data....K..........................@....rsrc...............................@..@.reloc...'.......(...T..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\SDPlugin\AdPopWnd.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):500072
                                                                                                                                                                                                                          Entropy (8bit):6.532750941484401
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:5bpiJxhGDomLKdGfr2Jb4C0AVhJwEbkEXadqQ:2Fe0JSC0KwEnXadq
                                                                                                                                                                                                                          MD5:FE942B71A343CF8813BC25D47F829436
                                                                                                                                                                                                                          SHA1:3277A962B178621542F4382F1C8D8981E71C4B9E
                                                                                                                                                                                                                          SHA-256:F5883765DC27F6D169D09F8BDA005B1D30E5CCAB568512A5AF3DA369216935A0
                                                                                                                                                                                                                          SHA-512:6DDE8852BB0F7CF0712053ECA6C9DAC6407A71F715064DB4B3909B6836FD3D93008BF9F6FAD4A755205DAC1107DF04B2F724D1C504E1DB302766D487B6A0646C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..8m..8m..8m..&?..<m.."..;m..1...wm..1....m..1...m......;m.......m..8m..l..1...ym..1...9m..&?..9m..1...9m..Rich8m..................PE..L......]...........!................nS....................................................@......................... ...m...........P...1...........l...4.......<..................................8R..@...............$............................text...4........................... ..`.rdata..............................@..@.data....v..........................@....rsrc....1...P...2..................@..@.reloc..pc.......d..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\SDPlugin\PopWndInit.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4889
                                                                                                                                                                                                                          Entropy (8bit):5.352930231297318
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:31wB+RHzBUp1f+vHzBY3s1k++hHzB1cvccIFCcv3cIs19+iHzBTIxis1C+1QHzYA:W7sv3ivM/IdiW1d5cjmJodTkR/NSb
                                                                                                                                                                                                                          MD5:C7F41F9374CE2EDEB014AAB416B8CB63
                                                                                                                                                                                                                          SHA1:A1FF3FE46CE645CB0742AB8A084E346041F104C7
                                                                                                                                                                                                                          SHA-256:5DE37F6F9F2F6F2AACADCF88FB33E2D83F0434758C9FD44548D435BC6889D7A5
                                                                                                                                                                                                                          SHA-512:CC59988491BD87365CBA425A07A01A7082ECB6168372D31A22E5CA7886704C643773B56AC0F488E7A5D0496080CC18F309D26A6552D4393389B6B35093AD85C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.<?xml version="1.0" encoding="utf-8"?>..<ADItems>.. <ADItem id="1002">.. <DisPlaynames>.. <DisPlayname name=".."/>.. </DisPlaynames>.. <Processes>.. <Process path="%install%\FlashGetAdProcess.exe" type="1"/>.. </Processes>.. </ADItem>.. <ADItem id="1003">.. <DisPlaynames>.. <DisPlayname name=".."/>.. </DisPlaynames>.. <Processes>.. <Process path="%install%\External\FetionExternal.exe" type="2" lev="1" info="......">.. <Rule width="703" height="452" class="NakedDialog" caption="......"/>.. </Process>.. </Processes>.. </ADItem>.. <ADItem id="1004">.. <DisPlaynames>.. <DisPlayname name="......."/>.. </DisPlaynames>.. <Processes>.. <Process path="%install%\SohuNews.exe" type="2" lev="1" info=".....">.. <Rule width="692" height="473" class="SGNewsWindow" caption="....."/>.. </Process>.. <Process path="%install%\MiniHost.exe" ty

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\SDPlugin\PopWndTracker.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Generic INItialization configuration [SafeSoft]
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3109
                                                                                                                                                                                                                          Entropy (8bit):5.101450456756321
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:d4zPJI7NsrLWMG48d3O2TUPQbSzd6T+YmemiRIx:yzC+nWte2TZbS0kTx
                                                                                                                                                                                                                          MD5:EF7EBEF28941211CE7E7CA59334FF830
                                                                                                                                                                                                                          SHA1:CD11943C230E43AFEE755D90E20AEF94EBE0A7CA
                                                                                                                                                                                                                          SHA-256:547BCECFEE3185A686E4946BED468160069DB5875ECA1F107487E1611C793334
                                                                                                                                                                                                                          SHA-512:3187BE0052D377BDC0D93B96D671BA86AE4B350FB9930F9CF26CF1847AE76D221B96E07CC78C39331C76BF40B2DB17288CE2DF2DC9EECD990D00E3F4839D89E2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:[IMMail]..1=fetion.exe;AliIM.exe;tm.exe;outlook.exe;msnmsgr.exe;Skype.exe;alicall.exe;hiplatform.exe;SinaUC.exe;..2=BaiduHi.exe;YahooMessenger.exe;MyPopo.exe;icq.exe;RTX.exe;360seNotify.exe;sogouflash.exe;CCTalk.exe;..3=WavMain.exe;360chrome.exe;..4=usbkeytools.exe;hexin.exe;TdxW.exe;RainMain.exe;photoshop.exe;et.exe;....[SafeSoft]..1=WDPayPro.exe;QQPCMgr.exe;WDSafeDown.exe;KWSProd.exe;avp.exe;kav.exe;avpcc.exe;egui.exe;bdagent.exe;bdmcon.exe;ashdisp.exe;kvfwmain.exe;..2=RsMain.exe;Rav.exe;kav32.exe;kavmain.exe;kismain.exe;KVMonXP.exe;avgas.exe;avgcc.exe;avgw.exe;avgui.exe;avgwizfw.exe;avgfws8.exe;avgfws9.exe;avgfws10.exe;avgfws.exe;avcenter.exe;..3=MPAVMain.exe;VPC32.exe;uiStub.exe;uiStub2.exe;SymCorpUI.exe;MainStub.exe;NAVW32.exe;SavUI.exe;pccmain.exe;UfNavi.exe;TmPfw.exe;PccNTMon.exe;SPUninst.exe;ShorcutLauncher.exe;mcconsol.exe;..4=mcmnhdlr.exe;mcagent.exe;mcshell.exe;ashAvast.exe;aswAvast.exe;AvastSvc.exe;DrWeb32w.exe;dwscanner.exe;cmdagent.exe;Pavw.exe;Iface.exe;Avtask.exe;PSUNMa

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\SelfProtectAPI2.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):322984
                                                                                                                                                                                                                          Entropy (8bit):6.690408260100255
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:IlW/cN0IlnXIUPbMnHiDvttzJuCdTlW5MKuNcsN2://wl4UPbMnqzUCBl2gNcW2
                                                                                                                                                                                                                          MD5:F30972B1F02BF8520DC60778B94D8A71
                                                                                                                                                                                                                          SHA1:3136254F220E7902470CCEC4265BF3FC75119447
                                                                                                                                                                                                                          SHA-256:43529FC4C6EDA059C7091E1B7A91B662230B2C67DF22F84769BCCEA96E17ECDE
                                                                                                                                                                                                                          SHA-512:B763CBC5035ACE544F69137F9900A2B86365C7B0006F1BBDA683A4C43D4E464B85B7EB28B85EE8869D2ED40487A92CA3905506D8CB70AAB80E02DF3CCFBD9CE9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...N...N...N...6S..N...6L..N...6Z.N...6J..N...N..qN...6].N...6K..N....M..N...6H..N..Rich.N..........PE..L...9E.W...........!................B.....................................................@..........................i.......W..........D................5......@*...................................4..@...............$............................text............................... ..`.rdata..............................@..@.data...PN...p.......T..............@....rsrc...D............p..............@..@.reloc...*.......,..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\SomProxy.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):500968
                                                                                                                                                                                                                          Entropy (8bit):6.588411424843017
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:j0fCiJUmeO8+zrmCzb+gbEyX6KZZ1aeHIcUCY7D17BcSFNlZLwt:x4yeHU17BBBGt
                                                                                                                                                                                                                          MD5:9FC415C22AFAEF5589C27E7FC51C69DC
                                                                                                                                                                                                                          SHA1:4A80183341D29ED1768C8D4921790304CBA34758
                                                                                                                                                                                                                          SHA-256:3197F2B656C76AE351B7C4C3FEFC9B6831596477029EFC3B1B958C30F256DA5C
                                                                                                                                                                                                                          SHA-512:F92537EED9A56FB9D7854D8C06AC8B819A5E8C21C26D72A682829059D5AFFB7275D3BCA171246B9C53A9DAEC40C2C31BB0E620B55C010BD08CACB372CCDEEEF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.............8P5......g6......g . ....g'............................g)......g1......M7......g2.....Rich............................PE..L....WCe...........!......................................................................@.........................P.......\........`..p$...........x..P,.......@..@...................................@............................................text...*........................... ..`.rdata..f8.......:..................@..@.data...\f.......(..................@....rsrc...p$...`...&..................@..@.reloc...U.......V... ..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\UDiskScanEngine.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):334848
                                                                                                                                                                                                                          Entropy (8bit):6.621485169086845
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:WdcXDE6ZfWQwbKv6kHCFQa2SeRtoCo9TBHvZiX9o:WYo60db8RHCF7j6zo9TZvZb
                                                                                                                                                                                                                          MD5:3434CC47C7A4D6AB732EA5C63702D636
                                                                                                                                                                                                                          SHA1:8D7C31A5079EF8C80BE0A5F0A78431A07B647E20
                                                                                                                                                                                                                          SHA-256:41C2D54116E466105DDA4C0EA1BC3060CFDEBEE323C07AD48E0B683DF79CAA3C
                                                                                                                                                                                                                          SHA-512:483FBDC6C8A1BF78FDEB845B996A0B394192BE36BEE5FA2ADF44C1D13CD73DF4D3B3307798E88593B6CD79F52F9EC25296C6E82C05A3C458E161BF1E21679704
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}_...1...1...1..d....1..d..z.1..d....1...\...1...J...1...0. .1..d....1..d....1..N....1..d....1.Rich..1.........................PE..L......\...........!.....v...h.......&.......................................0...........@......................... ...}....w..........@...............h7......X'..................................F..@............................................text....t.......v.................. ..`.rdata...............z..............@..@.data....N.......*...t..............@....rsrc...@...........................@..@.reloc..*;.......<..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\VWallet.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):246848
                                                                                                                                                                                                                          Entropy (8bit):6.63872474499478
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:4g9z83hLJ0hZwcIBxyelSIPhiccIapJA5:4g9o3hLcZwRBlSyhWa
                                                                                                                                                                                                                          MD5:02E31B34CD4052F696D2F41C992BC3AC
                                                                                                                                                                                                                          SHA1:6DC4BA93B2D95D6AC935E57A805B0F48E119249E
                                                                                                                                                                                                                          SHA-256:BA8DF913DE44F5CE98182C8134472A9DF6083E89C33C7E72F0188B0F5FE2121C
                                                                                                                                                                                                                          SHA-512:F8324C0E85E40C3E606B2E5E1B9FACECC825FA9B43C7091DB65E890B592A463411841A32175FA096456EADD5639C7D2548935A49101C9DB9658C6C1C474D516B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+O.o...o...o...fV..}...fV......H...|...o.......fV..-...H...n...fV..}...fV..n...q|..n...fV..n...Richo...................PE..L......[...........!................................................................o.....@..........................@..O....1..........8................7.......".. ...............................(...@............................................text.............................. ..`.rdata..............................@..@.data....M...P......................@....rsrc...8............L..............@..@.reloc.."0.......2...X..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WDPayPro.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2104896
                                                                                                                                                                                                                          Entropy (8bit):6.455417895825204
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:H8sPNz8eJCVKpJmgO79slwQ2T5ym64dcrlrTxFr+q:H8s18eJC9t79dTTwm646fN
                                                                                                                                                                                                                          MD5:24D97A6259A068652A851A9AAD091510
                                                                                                                                                                                                                          SHA1:65FFB22E9A4E4EDCE9B26CA108DE2558EB17472A
                                                                                                                                                                                                                          SHA-256:FD4631FF9D9526449DB92C686A5DAB4A228B54F04486572E57200A0B1BE01C03
                                                                                                                                                                                                                          SHA-512:2292E7C96447C15864F8C4CBFE5635A56D91685530E0C7BF2FDB5950113D60137A459F9080D73D2F69D5C7E8F57BB9052FD7A471765E29000F148756F0E0F671
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........).4.H.g.H.g.H.g:..g.H.g.0|g.H.g.0`g.H.g...g.H.g..mg.H.g.0jgRH.g...g.H.g...g.H.g.H.g.J.g.0mg.H.g..}g.H.g.0xg.H.gRich.H.g................PE..L......[.................V...........d.......p....@........................... ......i ...@.................................|........`...o...............7...........z..................................@............p...............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data........P...d...6..............@....rsrc....o...`...p..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WDRecord.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):192000
                                                                                                                                                                                                                          Entropy (8bit):6.582588423085519
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:JaMEfq6ok7YfYINHDsLBbkqT+9HOfjh2N38n6PgNm/5aVm1xOAaFM:JaMESI7sfOLtkk+B+jh2N38n6I0E69
                                                                                                                                                                                                                          MD5:45760E2AD0F54207D6D1435D0FDE42A6
                                                                                                                                                                                                                          SHA1:0C4954C26D8EE24318CDBF739BA117008EAC298A
                                                                                                                                                                                                                          SHA-256:A45B487D063226695C641485DCF939C51F99626A23B440388B35F23AEB684EA4
                                                                                                                                                                                                                          SHA-512:B0F5D9BFBDFEC7291C41FF6C24BD0C9F82E1F173C5F3AB31A5EE94AA839AD83578E4869B0BD9737926736342C14A7C938C451EFC57F6F320560101080500E710
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B.B#..B#..B#...l0.@#..K[3.P#..K[%.?#..K[".x#..e...S#..B#...#..K[,.^#..K[4.C#..\q2.C#..K[7.C#..RichB#..........PE..L....RTV...........!................h................................................D....@.........................@v..c....k..d.......................h7......8...@...............................XP..@............................................text...R........................... ..`.rdata...f.......h..................@..@.data....G...........`..............@....rsrc................~..............@..@.reloc...*.......,..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WDSafeDown.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):289248
                                                                                                                                                                                                                          Entropy (8bit):6.507018143696409
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:mn+UTkxwvcG1f0pFoNGH79AyFWLD0ff/bdULdoQMz/a6TB9:E+UTkxwkG1HGH7yyFWLMf/bSRRM7B9
                                                                                                                                                                                                                          MD5:5F0EC71E12648D465454F03604FAF817
                                                                                                                                                                                                                          SHA1:D6CD582AA57A130C1F91251ADFC4F96FE90D83F9
                                                                                                                                                                                                                          SHA-256:1063678546A73C6870BDFF6FC8D8BFF9975687BED13A2ACB26A147EEEBAD3991
                                                                                                                                                                                                                          SHA-512:B7857BD2B53E4E49F616CE664984A67E65766F877BDE72A7BAB177B3D0571449597CF1BEA4B802633125C88F905614C4D6B011EF71C0752A6A3B6F5F3A6ED7C7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........L...........................!..........................g.......................Rich...........PE..L......V.....................R....................@.................................{G....@..................................n..........._...........8..H1...P...%..................................0D..@...............@............................text...+........................... ..`.rdata..j...........................@..@.data....\.......(...v..............@....rsrc...._.......`..................@..@.reloc...6...P...8..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\WscReg.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3082096
                                                                                                                                                                                                                          Entropy (8bit):6.813822076249885
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:cjG+xj8kwNaKd5hZu1hSPBpTmINewfM6SVzjYq+ZIqa5UJoec7:c5j8kwlHOhMBrBfM62jYqt7
                                                                                                                                                                                                                          MD5:C7DBFD0D17929C83F12080EB4680595F
                                                                                                                                                                                                                          SHA1:210F608A7929BF4085815522FFE2695063125E69
                                                                                                                                                                                                                          SHA-256:A628B37DF526093026862A1180484BEECE436B5DFBA83648551FE57CE9A5DD75
                                                                                                                                                                                                                          SHA-512:7D8D5B387CF65920E7A1F2AA7C0CE111EB5D600FE69EC48C66F3BF05C870DAD0E34D9637B1852AF0F379495BC3EBC277D130D14701E2B4114F8D50BAB057C5F3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$..w..w..w...v..w..|w..w..qw..w..`w...w..vwK..w.~.w..w.~.w..w..w...w..qw...w..aw..w..dw..wRich..w........................PE..L.....`.................\...X%......M.......p....@..........................0/......//......................................D..|.......Tf"..............L......<...pz..................................@............p...............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...........D...h..............@....rsrc...Tf"......h".................@..@.reloc.............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\acls.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1644
                                                                                                                                                                                                                          Entropy (8bit):3.3319479605896576
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Q+XqAFSk6lELipNo7k4+8Xongpu9UTndxdUKylXebI5MDKurpObRDdlOe3l3g26z:rt8/Ect4apLi2M
                                                                                                                                                                                                                          MD5:BC27ADBDE5C64034F93E22A1BD1DC636
                                                                                                                                                                                                                          SHA1:8D6DBB6BA9DFA967595BD516599B64095D82A627
                                                                                                                                                                                                                          SHA-256:DE496D02F5FADB91693B5AF115F38EEB1AD6683C3591145DE894A554BAC3149E
                                                                                                                                                                                                                          SHA-512:F97799B5BADF3A50CF76915BD6851A773AE983EF8A029850DA5F709EC66D8FB98DB27F0951465C51FB1FC8359300A123181AEAB3B78D15255628A7532713E015
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.a.c.l.s.].....i.t.e.m.s.=.3.8.....f.i.l.e.0.=.s.a.f.e.m.o.n...d.l.l.....f.i.l.e.1.=.p.a.i.r.s...i.n.i.....f.i.l.e.2.=.p.a.r.a.m...i.n.i.....f.i.l.e.3.=.r.o.u.t.e.r...i.n.i.....f.i.l.e.4.=.w.d...i.n.i.....f.i.l.e.5.=.j.s.f.e.a.t.u.r.e...d.a.t.....f.i.l.e.6.=.u.r.l.l.i.b...d.a.t.....f.i.l.e.7.=.u.r.l.l.i.b.a.u.t.h...d.a.t.....f.i.l.e.8.=.u.r.l.l.i.b.w...d.a.t.....f.i.l.e.9.=.w.d.b.l...d.a.t.....f.i.l.e.1.0.=.w.d.c.n.f...d.a.t.....f.i.l.e.1.1.=.7.z...d.l.l.....f.i.l.e.1.2.=.3.6.0.q.w.w.w...d.l.l.....f.i.l.e.1.3.=.3.6.0.w.e.b.p.r.o...d.l.l.....f.i.l.e.1.4.=.a.d.f.i.l.t.e.r...d.l.l.....f.i.l.e.1.5.=.e.x.t.s.m.a.r.t.w.i.z.i.e...d.l.l.....f.i.l.e.1.6.=.i.m.h.e.l.p.e.r...d.l.l.....f.i.l.e.1.7.=.s.a.f.e.h.m.p.g...d.l.l.....f.i.l.e.1.8.=.s.e.p.r.o...d.l.l.....f.i.l.e.1.9.=.s.v.h.e.l.p.e.r...d.l.l.....f.i.l.e.2.0.=.u.r.l.p.r.o.c...d.l.l.....f.i.l.e.2.1.=.w.d.r.e.s...d.l.l.....f.i.l.e.2.2.=.w.d.h.o.t.f.i.x...d.l.l.....f.i.l.e.2.3.=.w.d.u.i.2...d.l.l.....f.i.l.e.2.4.=.w.d.u.i.3...d.l.l.....f.i.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\chrome\360webshield.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):359904
                                                                                                                                                                                                                          Entropy (8bit):6.561889344244544
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:EO/q/V7Lrgnie135sVgVsyFSQf/hosPkA52QQ8arHhsxbgvneH9T1wZec:EO/qtZe1pDwIhosPkAJUnedT1wMc
                                                                                                                                                                                                                          MD5:58D7400E2A8EFA0E6D34846C174E8B45
                                                                                                                                                                                                                          SHA1:1AE2C770BC39E419E2C837BBB31617DBB33736E6
                                                                                                                                                                                                                          SHA-256:28AFDE07B1B77509DBDEDD92AE443959A5DC431FE8BA7CB5708E1051CD72578D
                                                                                                                                                                                                                          SHA-512:15FB895E1E377B29FB5F87C56B62B6B37E64E56D718E8764714A1E453D3426BA24A941B78A28445EDD9BC66E70DC2399A688BD1BBA262D68F03278B1912248DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$...........O..O..O....M......M......D......L...ZY.C.....M......o......K..F.>.M....N...fl.X.....D....D......L......E.....U......H......N......T..O..5....V...T.N..O.<.N....N..RichO..................PE..L.....*f.....................^.......Z............@..................................H....@......................................... ..pG...........T..H)...p...'......T...............................@............................................text............................... ..`.rdata..(...........................@..@.data....7..........................@....rsrc...pG... ...H..................@..@.reloc...'...p...(...*..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\chrome\manifest.json

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):417
                                                                                                                                                                                                                          Entropy (8bit):4.906679178775407
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:1HA0xnHvaAKRXLA1DCzpCjsJBjpCjtPi1Y:1HFxnPaACbA1OzpIWpIJX
                                                                                                                                                                                                                          MD5:D5BD4CBB06205469D237E39C54549101
                                                                                                                                                                                                                          SHA1:94848AB9DCB5535D1E05E08C6B9435611A429595
                                                                                                                                                                                                                          SHA-256:F56C41C3D95488EF6C813502C33F4722C4788815E6D121027345AF1C114AF4A2
                                                                                                                                                                                                                          SHA-512:F00D2759A8E99D1EF8ABEDD52353F1A991905C1302A6D53DB52BDE41C9F9C9042D052ABD55E3DC0A4AA7EF0162530A91AE18EA74FCE859662713A0B9B5A764F1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:{.. "name": "com.google.chrome.wdwedpro",.. "description": "Chrome Native Messaging With 360webshield",.. "path": "360webshield.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://glcimepnljoholdmjchkloafkggfoijh/background.html",.. "chrome-extension://cnpeghmjdfdmneiljeibjnemfdkojdhl/background.html",.. "chrome-extension://okdacpiidbbphpjpfmecjjhicomjdeie/background.html".. ]..}

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\chrome\manifest_firefox.json

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):224
                                                                                                                                                                                                                          Entropy (8bit):4.824414490932177
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:3H9ifFwI0zjaHo8WAUNVimOzWEPqNFTHJY2RV17F4TvFFa8f0LpyZ64R2uqy0uEL:3HWz0/8e/ihvyXtY2RVbUvFFaF1hyzsL
                                                                                                                                                                                                                          MD5:CDFB4E35141A5911D79758DF0709D73A
                                                                                                                                                                                                                          SHA1:94E11A26FE9B6CC95BFE8610FF182E2A92F1C9EF
                                                                                                                                                                                                                          SHA-256:06B5025575DADA684F4CBAA3695820849F6EBFFD65B86241921BE9C19EB1E59D
                                                                                                                                                                                                                          SHA-512:4F15C071620DC1776C2DE397C7613557E785D7E6B2D98F6DA5B298B73A61865520CB460777AC8214A84CCC23A7683424D2843409FE703486FC2967F63F2D8196
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:{.. "name": "com.google.chrome.wdwedpro",.. "description": "Firefox Native Messaging With 360webshield",.. "path": "360webshield.exe",.. "type": "stdio",.. "allowed_extensions": [ "InternetProtection@360safe.com" ]..}..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\chromesafe.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):377064
                                                                                                                                                                                                                          Entropy (8bit):6.67867256260425
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Q/tmOmZqZNoF4qY/tNLQ1a6rHL04kSF79AOHYtilOFEKTe954NR:emOmZqZNzya6rHL0VSTpY8OFEKTe90
                                                                                                                                                                                                                          MD5:5E556243F4527EDED0F72CBDCA7D6BFD
                                                                                                                                                                                                                          SHA1:861102E93005DFA11FCF7DA0FA9CFF1C6C925491
                                                                                                                                                                                                                          SHA-256:7A73B8BD126BEECDDCEE95F098EF81BE11503B1723F0B6AA20D2A48C27100627
                                                                                                                                                                                                                          SHA-512:B3842821F02C8178AD0DFEEF07B319BFA00E4C1BE9645BF02DBD931B3D943575194A52BC65CAC21A1945929C6F0F01D5D47FF70FDC9FCE517DEAC64C92CE93AC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V..8...8...8..H...8..H.:.8..H...8.,t....8..;...8..=...8..<...8.......8...9.-.8...1...8...8...8......8......8...:...8.Rich..8.........PE..L.....re...........!......................................................................@......................... ...L...l...x.......................P,.......<......p...........................0...@............................................text............................... ..`.rdata..v=.......>..................@..@.data...("... ......................@....detourcX5...P...6..................@..@.detourd$............N..............@....rsrc................P..............@..@.reloc...<.......<...V..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\chromesafe64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):468200
                                                                                                                                                                                                                          Entropy (8bit):6.273044616861669
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:OZwfuenpre3vU4mw2k/D46k0wuglvjIdFaCOaO60Tn27kcn/+VGZboh+Zn35ckMB:Oqf0/FBbs6h+8dkCV/Jo4n35cS8l
                                                                                                                                                                                                                          MD5:BB037DCC8F6549985422A96000244C8C
                                                                                                                                                                                                                          SHA1:4C7400E6B574885C63067053F0A29733A6BEB914
                                                                                                                                                                                                                          SHA-256:88923A3D2D5ACF7E619D263C5BC7FCBB2B6125894E002AAF61384668457428B4
                                                                                                                                                                                                                          SHA-512:EDFDA00CA64D982564A113D0B6F58C88888AD59A6F001FCBF41CE7F550FC5EBA7C3DE71E891B4B41CD128A3F83BF3EA62451981B05F196A5F12D6EF644445630
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......H!...@...@...@......@.....@......@...!..@..^(...@..^(..0@..^(..-@...8u..@...@..@..)..*@..)...@..)...@..)...@...@q..@..)...@..Rich.@..................PE..d...0.re.........." .....H...........p.......................................p......RL....`..........................................%..P...@&..x....@..0.......H6......P,...P...... ...p............................................`..8............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data...<1...@......."..............@....pdata..H6.......8...4..............@..@.detourc.g.......h...l..............@..@.detourd@....0......................@....rsrc...0....@......................@..@.reloc.......P......................@..B................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\disproc.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):93152
                                                                                                                                                                                                                          Entropy (8bit):6.624094353118549
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:TGurKTzN/wkQtf617oRWwMksSiMloawyDJpauny8Due+fZG6KeZV/z9leLkeMu:8N/tQNctzCz9pauny2N6tZNz93eMu
                                                                                                                                                                                                                          MD5:A9C1F9DCEDA79A57BEE414826A76A65A
                                                                                                                                                                                                                          SHA1:2F9AC9388520C77CC1B44D9E6AF5214A97116F4C
                                                                                                                                                                                                                          SHA-256:301406355A71613BB18FB67DADD18362FD0744E3DC1422DF4214F728AD31E761
                                                                                                                                                                                                                          SHA-512:799A48630874E03648AE4D52910E5C9276056739DD4072BF7E852124F649EBE826502E0555BF3BB020AD69DA920CA6BBAB8B1FA115F9E09385BDAE0E300103CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................x.......n.......i.....6................g..............y.......|.....Rich............PE..L....Efa...........!.........d......$7...............................................^....@.........................p...G.......d....`...............,..H?...p..........................................@............................................text...R........................... ..`.rdata...3.......4..................@..@.data....2... ......................@....rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\dlproc.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):733808
                                                                                                                                                                                                                          Entropy (8bit):6.633253311276677
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:EvLOfl0ManPdz5f0eNCDGPrtx+sIYU9BBk16Fj8PpJR/nGwy890ah4CWPcxjiPoB:EvLOfKManPdtfXNTJEwJaOWPoOA9TUM7
                                                                                                                                                                                                                          MD5:0B3A2A7A63F438A13DD6DDE7131A74BB
                                                                                                                                                                                                                          SHA1:83CF9CFDF27F5A982F631E8383BA4100CDE3BB3F
                                                                                                                                                                                                                          SHA-256:09C12770A6B54AD1DBB1799472A53244DCE083974DC797C67DE1BA3F394A8F5A
                                                                                                                                                                                                                          SHA-512:3A95AEDDF77D9AB7DFB5B7E51690BAD5BA957268B3FFF2E541E591E2C5D2FCB4843CCEE1E80DD72797B6BE0038E206BA6A8137AD5E9FAF25B124244EB893A83A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2..2..2.....1....X.0..;.[.'..;.M....;.J.t......+..2.....;.D.s..;.\.3..,.Z.3..;._.3..Rich2..................PE..L...^.WV...........!.........F.......)...............................................d....@..........................p..z... \....... ..p....................0..Xe..@................................................................................text............................... ..`.rdata..............................@..@.data............D...f..............@....rsrc...p.... ......................@..@.reloc...g...0...h..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\execrule.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):100629
                                                                                                                                                                                                                          Entropy (8bit):6.954658176473354
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:oW2hLZfc9GLRDnLjvnCcAw8YHZk9b9k+1x5TRBUNdGp02rjWq1LMIbMqPQ907DP/:yCQLRDn/nCcVHZ10fqcpJrjJL7TgQ+0
                                                                                                                                                                                                                          MD5:F731A53EA773D1E8D6024AFAA1C3B706
                                                                                                                                                                                                                          SHA1:835B48EBC132E3058AE11A4DA915C4BCE8B2045C
                                                                                                                                                                                                                          SHA-256:9EE7865E9DC0A25C4B14B0D48F5F981A65D817C04C821B797A11F199A7D71A7D
                                                                                                                                                                                                                          SHA-512:60006F41E051E4646B2F005E2A470E01AA8BFF21BB6908AAE229D7DC91B200CEE9C4913BA0320BDD77E04A4EBDEDE2DF0EB5CC6C410DA78A472DB6E8B29DBDF5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:Q3ER................9...5...uIHO|]HO.M'..l.{6.U.Wv..u?-MHOm...uIHO.]HO.kc.E.....5. .e.7x.TKHO.)..uIHO8]HO......$...........(.IHO.)..uIHO+^HO.........|...h.Z....RKHO.)..uIHO$UHO..f....Cg..q..".M.HIHO.)..uIHO.iHO.....z.#...`...~...KHO.j..uIHO.kHOQIHO>...$....g.....yIHO.)..uIHO6kHOQIHO.....lf.=~....CHHO.)..uIHOQoHO.......?#t........*vOHO....uIHOQaHO/.x..~x,.j...RG.[3fIHO.)..uIHOQeHO..k..4..b#.6.,..r...9HHO.)..uIHO}fHOQYHO.;.t.+...EI..V.MHO{M..uIHOQyHOmu..&z.y...L}<......OHOQ..uIHO.xHO..Y.....!........%$..HHO.)..uIHOQ{HOH..e.E..y..>.+.L.#HHO.)..uIHOQ}HO.....a..v..k..fZJ..MHO.J..uIHO;}HO..Y..@.Z.;..uNl..\..&MHOm...uIHOQ.HORl..o.R..H.'.h..C...MHO@M..uIHOQ.HO.l..z..3......ly.k.s.MHO.M..uIHOQqHO.....<K...1.t_N.....IHO.)..uIHOQqHOG.....m..W...q....MHO.J..uIHOQsHOIL...*S.W..>2..0.~.OHO...uIHOQwHO.d...(..h....h..~.LIIHO.)..uIHOQwHO......lk.v.p.K.>J.JY.IHO.)..uIHOQ.HO&dw.O....~":..S[...IHO.)..uIHOQ.HO.....&....Ra...I....LHO....uIHO%.HO..Y.....B%.5.h@.....OHO...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\gamemode.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):194512
                                                                                                                                                                                                                          Entropy (8bit):6.5814699778110315
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:CPPiPKVGnzhfteMpjyrR+dWwgWmAaqUa6lqG+W/HGiKtF:CNGzhc7FsWwgWwVaMP1rK
                                                                                                                                                                                                                          MD5:B803F8310E3CE8D2424E136E44DF3D9B
                                                                                                                                                                                                                          SHA1:C9AF9CD35594B54B663E6B2DD817ADD99A6A3645
                                                                                                                                                                                                                          SHA-256:843855B8C531CBD8CD349C3F54A0D13CACC2832321FADC991162EF8E8C7E19DD
                                                                                                                                                                                                                          SHA-512:455B5FA34D562A1584B25448EF3575CC4E5D75CCE34CFC62B7B30AF44D584FD6533FF79264D253BF564DFD98813DDF7B26894AF5EA7CFE5433AC5644E8D444BA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i1.s-P. -P. -P. 3.s )P. ..a ,P. $(b ;P. $(t .P. $(s jP. ... /P. ... :P. -P. .P. $(} 0P. $(e ,P. 3.c ,P. $(f ,P. Rich-P. ........................PE..L....=.Y...........!......................... ...............................0............@.........................@|..P....o..........p...............8/......\...."..............................0Y..@............ ..4............................text............................... ..`.rdata...\... ...^..................@..@.data...8X......."...l..............@....rsrc...p...........................@..@.reloc.."0.......2..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\hookport.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75280
                                                                                                                                                                                                                          Entropy (8bit):6.7219074197289865
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:CYrDDnUe2rg97Nd/itEYfdLdOBGD/AdyOVhrQWUSVQVu69+lNn8eoz798q3CP:CWDnkrgVNdzSOBG/AdhVh5WVD9+lN+7m
                                                                                                                                                                                                                          MD5:A6DF39C0432E7B4830BF3EB4E4663E71
                                                                                                                                                                                                                          SHA1:88386C8821BD8A3E33E6D66856BB7F32912CA731
                                                                                                                                                                                                                          SHA-256:EA8513F676A23F5B460F3BF1D8697C14DBDF5D828FF2845B677BA9B19D3055C4
                                                                                                                                                                                                                          SHA-512:A7FF6D78B144651BDD70512FC98F4010832EE83D38DDB01292EEA25B42C9E96D5998FA5F7A3BB89239B3DF596805591A8593E77E33EEFE740335D09F3D088B51
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$............V.>M......[.h~%.w3Q.W...lf7.~..W|.9B34........z'..]...Q....p..!....}...+<....,Z5..[H@ ..J*g.7.x.....2...s..?.~c.eyD.Y..BK..`.......................................................................................................................................................................................................................................................5I..q(..q(..q(...'..p(..q(...(..(...t(... .p(...'.z(...'.p(...'.p(..Richq(..........................PE..L...^..`.....................<......................................................4...........................................<........................B......x......................................@............................................text...<........................... ..h.rdata..............................@..H.data...............................@...INIT....:.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\hookport_win10.cat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10198
                                                                                                                                                                                                                          Entropy (8bit):7.140095967091247
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:R53RDqnlyToxxmwBYyKaWFWQF5tCtkqnajbxL/:4bPCFRXJlPxj
                                                                                                                                                                                                                          MD5:4AD127499970CFCA45D014D013ACB062
                                                                                                                                                                                                                          SHA1:934A0ED8D53ADF073A28CB35DA0D13F4A6849A85
                                                                                                                                                                                                                          SHA-256:F47E685EB7528817DAC19BE0692761BBAEF8E3C734A6638F846BE80134F1E7B4
                                                                                                                                                                                                                          SHA-512:C98F326F308B63E16E16D90F853C8E48A32D5CF582E35A156C31F487171B69535DE07D6DFEE0BC80110F58016BF6418A02FF706E3B83CCF368827560980FCA33
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:0.'...*.H........'.0.'....1.0...`.H.e......0..{..+.....7.....l0..h0...+.....7.......0.-..N.....}S...210201121112Z0...+.....7.....0..X0.......g.7HQH.X..o..^...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........h.o.o.k.p.o.r.t...i.n.f...0.... ^.y.Yi.....v...(...d........M.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........h.o.o.k.p.o.r.t...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ^.y.Yi.....v...(...d........M.0.... .`..:O..^...b..H..<:..l..Q.9.y..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........h.o.o.k.p.o.r.t...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .`..:O..^...b..H..<:..l..Q.9.y..0.....x..j.D.&.X.&;u....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........h.o.o.k.p.o.r.t...s.y.s.......0...0J.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\hookport_win10.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):83928
                                                                                                                                                                                                                          Entropy (8bit):6.838148826784033
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:CKrDDnUe2rg97Nd/itEYfdLdOBGD/AdyOVhrQWUSVQVu69+lNn8eozC983kJ3CV:CIDnkrgVNdzSOBG/AdhVh5WVD9+lN+CE
                                                                                                                                                                                                                          MD5:D5A83A2DE681D02D2A6C4ACD35A7663B
                                                                                                                                                                                                                          SHA1:817778B691C4EB3AEA0FC813CB9E57E90661ED8C
                                                                                                                                                                                                                          SHA-256:D90F85007DDA5D5517316D52D4EAA54789234C69E3B244369EACE95D9C864FC8
                                                                                                                                                                                                                          SHA-512:454F5E1C6A5CB64B6305D72A37A4C9C3FCFA33DE3B27620CCA6C979AD688EE0164136A12D9D54DA355BAD42E27ACCFF7107C7EFAFACA3ED29AF25749D12B0127
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$............V.>M......[.h~%.w3Q.W...lf7.~..W|.9B34........z'..]...Q....p..!....}...+<....,Z5..[H@ ..J*g.7.x.....2...s..?.~c.eyD.Y..BK..`.......................................................................................................................................................................................................................................................5I..q(..q(..q(...'..p(..q(...(..(...t(... .p(...'.z(...'.p(...'.p(..Richq(..........................PE..L...^..`.....................<......................................................!...........................................<........................d......x......................................@............................................text...<........................... ..h.rdata..............................@..H.data...............................@...INIT....:.......

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\iNetSafe.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):585184
                                                                                                                                                                                                                          Entropy (8bit):6.602103821608402
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:HEczExa6SyUd5SGfZ7PVIa1j9N8ljqdT/PUS6Mo7SbXN2JBAusU/1BcBO9xrmZ:yc3eU87iXguuHBcB2xo
                                                                                                                                                                                                                          MD5:142683CD14916A78ED38C8A8000B8584
                                                                                                                                                                                                                          SHA1:DC6721D202CDF40910C40258A681036EBFC90185
                                                                                                                                                                                                                          SHA-256:63A73DF41533120D0DD7062AD49CF69EF4CAD42A4B405B84A76D228B12D0AC80
                                                                                                                                                                                                                          SHA-512:474CB8DBDA0901D3E7DEC2FE1C8A9F2D3C70F92DB4C5B08291102E246E23DB2F6D9C702F3A4861AE0B90CC817AE786E72C15AEFBEAD0DCAE98EBE6A385289B85
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$...........P..[P..[P..[.)I[^..[.)K[...[.)J[M..[C.ZV..[..ZS..[..ZZ..[Y.<[S..[...[W..[..ZF..[..Zn..[..Zq..[Y.;[X..[Y.+[M..[P..[s..[..Zn..[..ZQ..[..G[Q..[P./[Q..[..ZQ..[RichP..[........................PE..L...#..f...........!.....>...........\.......P....pe.........................@.......A....@.........................`.......D...........................H).......b......p...............................@............P..,............................text....=.......>.................. ..`.rdata..Z....P.......B..............@..@.data...t~... ...8..................@....shared.x............<..............@....rsrc................T..............@..@.reloc...b.......d...^..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\iNetSafe64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):611296
                                                                                                                                                                                                                          Entropy (8bit):6.240174418263777
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:uirK793OLeQ8quQtTxArnhF5hyzazoTBm/w2mTh:uirKceQ8quQ6hFbv2BmI2a
                                                                                                                                                                                                                          MD5:2A37ABC9D9A84AF70224232FE3DDF72C
                                                                                                                                                                                                                          SHA1:13B007DCEE749EBDAD4CF57EA57288D522C0338E
                                                                                                                                                                                                                          SHA-256:3675B186AE04C302C11B57B1B5C0C28145AE48B28C5DFC6F9943445A025B4B27
                                                                                                                                                                                                                          SHA-512:F7BDE3091E150A82A65C9D972035303C03706C90C6E3AC3EC8D28CEC4D8AEF8AD0A6B510F54D954CB480BF6998AF9CB9B29ED15E61116F0FE836B527F513C3B3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........ae...6...6...6...7...6...7:..6!..7...6!..7...6...7...6.3.6...6...7...6...7...6...7..6...7...6...7...6...7...6...6...6,..7...6,..7...6,..7...6,..6...6...6...6,..7...6Rich...6................PE..d...n..f.........." .........N............................................................`..........................................................p..@........L...*..H)...........}..p...................`...(...`~............... ...............................text............................... ..`.rdata....... ......................@..@.data....w...@...H...&..............@....pdata...L.......N...n..............@..@.detourc.F.......H..................@..@.detourd(....`......................@....rsrc...@....p......................@..@.reloc..............................@..B................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\libzdtp.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):569064
                                                                                                                                                                                                                          Entropy (8bit):6.427930617905209
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:lg8ecKzQsOlUUbTRS6mWvb9J2h8KiAdAD0zmz2wxh1ElHH:pS8bJ0dA3zrxh1Eln
                                                                                                                                                                                                                          MD5:819DE03E65A3241E06E73F4360C5E43C
                                                                                                                                                                                                                          SHA1:29F4B0A3B303EE0B016DC420308B3D0E24376552
                                                                                                                                                                                                                          SHA-256:D17BEDE2B39422D3A449D6BEF9AD39A95C6317F78DC268A56C393ED31A5799AA
                                                                                                                                                                                                                          SHA-512:DECF00363ADB4083C8A3BDE11505E72C8C278CE47B6BE92B1928D98306061C89FB45CA03927F52CFABE9BAE735CA502D1BF710923C07DF4F1A33633B66731249
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$....................r.i....r.k.I...r.j....c.....c............X,_........................................n....n.....n.g..........n.....Rich...........................PE..L.....e...........!.....h..........$................................................9....@.........................0...........x.......X...............P,.......G..@...p...............................@............................................text....g.......h.................. ..`.rdata..Ld.......f...l..............@..@.data....c.......(..................@....detourc.5...`...6..................@..@.detourd$............0..............@....rsrc...X............2..............@..@.reloc...G.......H...8..............@..B........................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\libzdtp64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):677096
                                                                                                                                                                                                                          Entropy (8bit):6.100014510049092
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:DiTsTbZhP9zpw/T5lnX4SP6+wd1QoVTPluda5:2TsTNhPtpMnfy+wME5u+
                                                                                                                                                                                                                          MD5:9FF25CAB0E6D436D0D289697EA4ED98D
                                                                                                                                                                                                                          SHA1:A714842A6D6881DE40E9548ACE5D91A5A8F3BC93
                                                                                                                                                                                                                          SHA-256:88EA7C33B62BFAF01AC1ED0FB7881166F852E85BB87846FD37D6B9738D0C320B
                                                                                                                                                                                                                          SHA-512:987645D544FB2D61B169C85FEDACE508DDB3AF7AF70EA515B57C87093F0DC59F0347B767C4F1A5B2BC20786B7F8A5BE57F37CD0AF76C01D2EE0BB3B608659145
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........C".."LA."LA."LA...A."LA...A-"LA...A."LA.KH@."LA.KI@."LA#..A."LA.JO@."LA.JI@."LA.JH@."LA.Z.A."LA.Z.A."LA.Z.A."LA."MAd"LA.KE@."LA.KO@."LA.KL@."LA.K.A."LA.".A."LA.KN@."LARich."LA................PE..d.....e.........." ......... .......X...............................................q....`.................................................T...x.......X........D...(..P,..............p...........................P................ ..x............................text...,........................... ..`.rdata....... ......................@..@.data........0...F..................@....pdata...D.......F...R..............@..@.detourc.h.......j..................@..@.detourd@...........................@....rsrc...X...........................@..@.reloc..............................@..B................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\netmon.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):374600
                                                                                                                                                                                                                          Entropy (8bit):6.499638567174418
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:PLIW1XUU08US2hugzPCOuJctydKoyYclZ0lVJ/:DIWFdRgTCOuJcEd1yuJ/
                                                                                                                                                                                                                          MD5:1AC8D58C7DA3B2C286B78352C4C2A73F
                                                                                                                                                                                                                          SHA1:5F85296795485F9BBC0631B786545EF1098A0E61
                                                                                                                                                                                                                          SHA-256:7FA8351D94F44FDBC7A955DC916F9D55E9D521613C1855F51B4AB8C1131890B8
                                                                                                                                                                                                                          SHA-512:E033590806208550694AEE06F30F97C3B130B60E0FC798C5A75F56BF892DE2656E5DBA1FD0A85E8DEED19711D2DEA56A3CE5F52906FF4B1B8601C4CFFEC0A04F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p..Q.`.Q.`.Q.`.OC.U.`..^..P.`.Xi..K.`.Xi...`.Xi...`.v...T.`.v...N.`.Q.a.p.`.Xi.m.`.Xi.P.`.OC..P.`.Xi.P.`.RichQ.`.........................PE..L......]...........!.........p............... ......................................h.....@.............................Q...T........p...................6.......3..P$.......................}.......|..@............ ...............................text............................... ..`.rdata..1.... ......................@..@.data....k.......>..................@....tls.........`......................@....rsrc........p......................@..@.reloc...Z.......\..."..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\psconfig.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:SYMMETRY i386 .o not stripped version 1162167621
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1616
                                                                                                                                                                                                                          Entropy (8bit):1.0314073852722707
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:VrWr9o3BXaLMKxZXZstzsAVKNnXqSn1V9hNVqXbC:Vr0sBXaVXXZstzsAVKNn6Sn1X7VqrC
                                                                                                                                                                                                                          MD5:F11DA41444FC34600BE2A0D012098D00
                                                                                                                                                                                                                          SHA1:EABBBB46D414F0EAA533CD76B04451EAF6D95BD9
                                                                                                                                                                                                                          SHA-256:3568619F7B96A595CABC6657266F142EE907DE43F3460AC0C4E2C43CB4C82DE5
                                                                                                                                                                                                                          SHA-512:27786D4C333613D4085CF74A1768880096CBCB55F2ABEA0226E6EE1C54EF3F6208427BB3B468120ED11B8272BDC294C2486ECDC892732BB68B6A18EB1E84EDA2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:...i.2f.O......e.1.P...........GEEE,E E=E5E)E*E7E EkE E=E EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEGEEE E=E5E)E*E7E E7EkE E=E EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEECEEE6E5E$E7E1E$E+E.E E!E"E EkE E=E EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEECEEE(E,E&E7E*E6E*E#E1E E!E"E E&E5EkE E=E EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEBEEE/E$E3E$EkE E=E EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEBEEE/E$E3E$E2EkE E=E EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEBEEE&E-E7E*E(E EkE E=E EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEBEEE(E6E E!E"E EkE E=E EEEEEEEEEEEEEEEEEEEEE

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\qutmvd.tpi

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):256512
                                                                                                                                                                                                                          Entropy (8bit):6.588892881622345
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:Uqwb20mSFhpfTdt32Cjag7MQ3DK/8aEVnKXi3mt9cJtbzvw+8yXemV0jr/BMlXln:UJjJ3TWyVAmVoEXsN4YORtz4ux
                                                                                                                                                                                                                          MD5:378FED355D6B9F0222C86501458441B5
                                                                                                                                                                                                                          SHA1:678437B54CD6F723EE7C88EA9C75B30C2A1CA19E
                                                                                                                                                                                                                          SHA-256:71832E9474AD9D9C575EA1B8F54858AF5CD0281F49C977D1FDA917D41681D570
                                                                                                                                                                                                                          SHA-512:31B2463C1FA5D37DEA97B080B715975A5473619C88DD27C3FBA66CA7B41C19794C5A3B32D2748592C4043921D7F4379D8C7C0EF76E6B06C2B5B2113AEA10B72F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........a...a...a....(..a....4..a.......a...a..'a....>.9a....9..a..../..a...3)..a....,..a..Rich.a..........PE..L......]...........!......................................................................@..........................j..Q...\^..........................h7......."...................................<..@...............@............................text............................... ..`.rdata..1...........................@..@.data...@M...p..."...Z..............@....rsrc................|..............@..@.reloc...-..........................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\router.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):274
                                                                                                                                                                                                                          Entropy (8bit):3.550129234783797
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Q+HcQuUuURlUyOOuRlUyMuUdM8J22OudRkd1WOMXCyVAD6lEmbql9:Q+HcGFqw28M1kSWASEmbql9
                                                                                                                                                                                                                          MD5:EB3203513E6ACECCED9219C608E3CBCD
                                                                                                                                                                                                                          SHA1:C25E3375D5F0786F0B8CC762961AB079F584C2EA
                                                                                                                                                                                                                          SHA-256:F396EA57808085D4D87CB326B05523B927D45854DA693E087216966BB0E46DD2
                                                                                                                                                                                                                          SHA-512:2A16E7B8814F75D66BF25CB730D9392008CD0D9B802E66D79EF7A6BAD333D0E6F9FD5877759381E1F949D13EA82A4390C6C1AEEC3B8CE4AA513BD4A919F87648
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.d.n.s.r.u.l.e.].....i.p.r.u.l.e.s.=.1.....u.r.l.r.u.l.e.s.=.1.....i.p.r.u.l.e.0.=.1.9.2...1.6.8...1...1.....u.r.l.r.u.l.e.0.=...*.(.u.s.e.r.R.p.m./.L.a.n.D.h.c.p.S.e.r.v.e.r.R.p.m.|.u.s.e.r.R.p.m./.P.P.P.o.E.C.f.g.A.d.v.R.p.m.|.s.t.a.r.t._.a.p.p.l.y.).\...h.t.m...*.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\spsafe.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):591752
                                                                                                                                                                                                                          Entropy (8bit):6.633298896930602
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:ymnWF4qfhahXwkw2dhOTFLrJU7KRsc4XCxnrp1/f3xT8a7kubpvxMSK9T2o795:MF4vGykrn/fhkubpvxC9T2o795
                                                                                                                                                                                                                          MD5:28C481DADF6956E80D257F4C122C1F88
                                                                                                                                                                                                                          SHA1:9454297EC927BB244A556804AD793C5BCCDE97BE
                                                                                                                                                                                                                          SHA-256:D8E355B43C71CF34D967E21D86C35A4614F998EF6D65E4BF6CCAD84B15152D88
                                                                                                                                                                                                                          SHA-512:749E2DD69ACBBEC03533D2C08120FE6114AFC6DD513C7E06D7FB9478ACD7341E4592151183E3571A5A3AB04798697203C7CA3D1AF4ADEEE69AC8DB9A96D699B5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yr.E.............k.......k..9...:.......:................k.......k.......k.......A.......k......Rich....................PE..L...a.._...........!.........:......c........................................@....... ....@.................................l........... ................6......4[.................................. Z..@............................................text............................... ..`.rdata...E.......F..................@..@.data............L..................@....share..8............&..............@....hlpsec..............*..............@..`.rsrc... ............:..............@..@.reloc..0{.......|...R..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\spsafe64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):814584
                                                                                                                                                                                                                          Entropy (8bit):6.257649144280152
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:Jx+6W6V2TyWv9kRr6kW6xRuDT4bXv0SwSvSnH1eYuO9TENDLmo3Q9W:2Z7FkRr6QxkDkTsSwSvSH/9TENfT3Q9W
                                                                                                                                                                                                                          MD5:4DE8276A50E3856A364AC67B3335C072
                                                                                                                                                                                                                          SHA1:4E48F52C8FD8CF5FD46562209B1754DEB5C4FD0B
                                                                                                                                                                                                                          SHA-256:CBD9DE6498C22914B7465C5FD06B29E25CCF243A3C71CDF183FFB37357A83E11
                                                                                                                                                                                                                          SHA-512:1C0CD61EC574E0C08EDA9C4ABBB52A71BB28C54FAEB5A8D348101C45986EC644578E9824A6802A6979545942F97AE9CEE974B89EC6D0A40B0624E2471626475C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................X.....M......M..............Q.r.....G......V.k.....@......F......C....Rich...........................PE..d...X.._.........." .....^...........(..............................................{0....@..........................................................................,..`A......h....y...............................................p...............................text....\.......^.................. ..`.rdata...Y...p...Z...b..............@..@.data............l..................@....pdata...............(..............@..@.share..@.... ......................@....detourd.....0......................@....detourc.!...@..."..................@..@.hlpsec......p......................@..`.rsrc...............................@..@.reloc.. ......."..................@..B................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\svcMonitor.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):285176
                                                                                                                                                                                                                          Entropy (8bit):6.36568298275723
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:qdi8EayNA8KGjyUWm+sG2Dif1JcUnOw66XjOBN6HBGLRc6YZPI93:qdi8EayA8KGjyUWm+Tf16gOe2c6GI93
                                                                                                                                                                                                                          MD5:E6E8CA5733E2BDA091327469391F4631
                                                                                                                                                                                                                          SHA1:C6FFACB21AF418DF14E713B59FA621F87275AFB9
                                                                                                                                                                                                                          SHA-256:4DB4A9145DADC260A2F9B0972E2F1F75F79958E2DBF75E48B77162E06CC8136C
                                                                                                                                                                                                                          SHA-512:DE61E6FE2E0A6D4C9DB2DD01927B7E30C0F72A6E059B739B7D8568F79600336C08AAAC4F57F656072514C857EF49443EA3CD57897C78FAC870C891C16ED4CB72
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........27..\d..\d..\d...d..\d...d..\d...d..\d...d..\d...d..\d.#'d..\d..]d!.\d...d..\d...d..\d...d..\dRich..\d................PE..d...R.._.........." .........(......p........................................p.......0......................................................`........P....... ..@/......`A...`..4...@................................................................................text............................... ..`.rdata..............................@..@.data....O....... ..................@....pdata..@/... ...0..................@..@.rsrc........P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\swverify32.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):124928
                                                                                                                                                                                                                          Entropy (8bit):6.65257150008607
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:mIRmP3FRoFyd56KeIMd/ISminRItKRDBSdELOlDww+5j6b1oFIsM:mQmPV2FyLpPMBHut/xZR+5j6baFnM
                                                                                                                                                                                                                          MD5:226A68710198FD152FDDFD0E6DB904D8
                                                                                                                                                                                                                          SHA1:20E0427A6DFE93B5BF65162E56A45BAA149E57B9
                                                                                                                                                                                                                          SHA-256:39F54D4C41F69CA88118BD134AB1FA38D9AF3BF4B438CC9297E2C360D75CCC3D
                                                                                                                                                                                                                          SHA-512:84D1C3726E34BF49E34B368B0A550C79BC29B29EF6538010F8EE26A2E0E8C8BF7877D5DF3D49B7EF259D7CC742FC244876DFA60A0A15579C16FE9FF67E33353B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{uE..&E..&E..&L..&n..&L..&W..&L..&,..&b.n&@..&E..&...&L..&U..&L..&D..&[..&D..&L..&D..&RichE..&................PE..L...S..^...........!.....>...l......yy.......P............................................@.............................{...p|..<.......................h7......X....Q...............................r..@............P..t............................text...5=.......>.................. ..`.rdata..+5...P...6...B..............@..@.data....1...........x..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\swverify64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):147296
                                                                                                                                                                                                                          Entropy (8bit):6.415865028032171
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:8YTXz0MC53HHOBMdaYdiHtM8Cd0QgMtRCwGZ25CMJ1vX7F0lO:8i0F53L8S6tM8C7gMuwsMJ1SlO
                                                                                                                                                                                                                          MD5:073A479B27025E1FB8387E3E008B1A7B
                                                                                                                                                                                                                          SHA1:3EF2F65F0D6B7604FC1DCA7D6315B1C937EB46C7
                                                                                                                                                                                                                          SHA-256:BA978851567B73D8BE47DF1519E069AC3220C00B0EBB774ABBF6AA27394B9ED5
                                                                                                                                                                                                                          SHA-512:862AAC20FD10A027147C78944F2F239F46FC274144E280C675A418C5A6E57753DBC80584FEB88B650C222D106B6E0AF9EA33A832C0FB742A88AA1A738824C6B3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1BV.u#8.u#8.u#8.|[..Z#8.|[...#8.|[...#8.R.C.p#8.u#9..#8.|[..e#8.|[..t#8.kq..t#8.|[..t#8.Richu#8.........PE..d......].........." .....n..................................................`............@.............................................e.......<....@....... ..0........4...P..x.......................................................H............................text....m.......n.................. ..`.rdata...Y.......Z...r..............@..@.data....=..........................@....pdata..0.... ......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\udiskscan.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3676
                                                                                                                                                                                                                          Entropy (8bit):7.7325846410217025
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:UKKL3PTHdOlpHtBjwfpqnZi0CVe+v2rEv7t/Xencr//aQ:UKKL3xUR7A400CVz8Ev7RXug/5
                                                                                                                                                                                                                          MD5:AE230D057354C6AF4295E7F86C0C6699
                                                                                                                                                                                                                          SHA1:1CDD1CE0642EA85CC1C763A1C8F300CB0580001A
                                                                                                                                                                                                                          SHA-256:5648AA10E976C1774D4F9BF479FEF51E718986E5B4C87A93DEF7B99A91431C57
                                                                                                                                                                                                                          SHA-512:D180AA756A686C9050DDAFDCBBE5DBDAF6918D2BFD01E0EA5F85402DBB80E9FB4ED80D5E5223EC13FE1864AF34FDD35B9557A43C33D46660AF01CE98231AC43F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1...0...0...1.0.2.2..............................................:a4................................................................u.d.i.s.k.s.c.a.n...d.a.t.......................................................................................................+kb.....rj...q.Tkxf2s.s.M..hHk.g..*.(...q.T.Y.......&......Hs...DBS....h.a...x.~.C.y.2?.R..q.;L.MDmff..2.....[S).7.......#.Xw%.Xw.`...0/...8.......-......0/...-.......8..\.M~.H.....eA...C7.8..#Wr..3..Bx7p........./Bm...({$......-~#.w..- T3m~B$e.t..\X....jq......y.....p.I@.l.!f......3...4|...Gt..Xe.{..^...U..=.,..g..HV.B..g........#..........[z.,....9Y.........L...A...*D\..j.O..6J....I.-.l.O.k...I3.C...j.f......g...8.h{A.MB;...%lJL.!..'~M....A....&.*..........Fb..C:.z...n..X.n.F...nS...:..oU..b>.o....B.f3..7..Y.47.84.\Y..w..,.cG.PZ3.3......+.G..A....Z-lp..9.......T.-...%.-.......R.0T....."..w...E...H.....S.A.....X.i.j.. i`..J." ....P9<B.LB/.&x....D}............'y.Pn.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\urllib.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):600584
                                                                                                                                                                                                                          Entropy (8bit):7.858058428207231
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:E4AikY6dtgb+LGcHVs1KmtG2sXcGP5+XIgkCs6TRRN7WHOuu:TAiB6uJc21SLsNXIz25o2
                                                                                                                                                                                                                          MD5:8C64AE610EA35FB1EBD7A6DBE4F51534
                                                                                                                                                                                                                          SHA1:9AF916676C573C5D164664C840578D027658BDF8
                                                                                                                                                                                                                          SHA-256:F31351216BC1C8550DAB806053A40C40E07873AF1DE14FF8BF848EF284673FA3
                                                                                                                                                                                                                          SHA-512:9CB191C5265101533EA5EC48160B465635E7A524DF40974FF6C3DCE0BA04B1358D5E16CE957CABC2338566A833EBF84E1AD7C2FB42FC9A34DA7AAF7DC54B00AE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..........x.!...E......y...fS.... .<A._.....xB,..v.DY.S^E....0..A...u..cPe.....<).K.P.A............uT.P...$.....Q....M...J.......?..Ma..bSgS....."..mW.;Z.ZHr.....|q...............Lt3.#.TU..........@.... L.....6....ch..."........E.p^mSj.....7.Z9.$.....4....&...L.....H .z..*.M.sp.3S....$..... e$.'.........0U.Z....(.U.3)..4...s.I..^..U....7..S.4.a.m;..[...8C...I.v....%.+..9'.yl....bu.*..9.l.}..M..s.kz..:.QTH........X..=.t..m^.Z...eX...>^..c..S+M].b+...A.l.3W'&.~y..Nn..B...k.....N.n....D.(t...B@...t1H..E`...zu...p....F9.~...c......U..G..i8.%..&..B...I..+P......,X..J...|...-.D$FR..Q/ v.3.p*E*`.....R.....a..Z)..c...R.z.m.J..n...AT..V..!...<....b...VF.....<....[..V[<f.......^....V.c."EH8..h.<.v..W.f...<C6..<AZ...Z.l..l.!2..I[...[Q.t..J64.......[....."`.....mq..a. ..>|....}k....bj....9k!c..W....b..CG.._.YKq.....d.o.h.....AZ.....g'..HF...|;...;..g..R......y]T.-..j.".w..._....w..l.h%....n.../L..l.Pp.u..<.G....n......Nj....s..-.v..:.Rw..u.....s.....Q...w.C.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\urlproc.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):700896
                                                                                                                                                                                                                          Entropy (8bit):6.66731130633744
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:k1rSyRo7iAd+mI0anDXztjzXvTwrHSDY8ORDksyvRTqfhoFFTfJAO9io9TR6ER:Rye+CeY8Ot5uFFTxAs39T0ER
                                                                                                                                                                                                                          MD5:C7215DE4D22C002F11C03734A9598B23
                                                                                                                                                                                                                          SHA1:B06FC8875E9136F89299C477341F4CA29937045F
                                                                                                                                                                                                                          SHA-256:3DDC6A07A914CD4F66A06B12DA14D8F38873CE47706415C5FA990D7FF7289598
                                                                                                                                                                                                                          SHA-512:C6BA9FE50AB0ECC8AAEC85CD816BA186A867B9220CE2FCA0F2EBC1007B088487A82DF3A96DF6D578CA19AB0F9CEA8DFB459CC8E82685A6F64EA72C096D2E04D5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^..?...?...?..`p+..?...G(..?...G9..?...G>.e?.......?.......?...?..+?...G7..?...G/..?...m)..?...G,..?..Rich.?..........PE..L......V...........!.....*...P.......*.......@............................................@.........................`................p..4...............H1.......Y..PD...............................+..@............@..p............................text....(.......*.................. ..`.rdata..{....@......................@..@.data....t.......@..................@....MAGIC..,....P......................@....SHARE.......`......................@....rsrc...4....p......................@..@.reloc...}.......~..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\wdblockij.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):57
                                                                                                                                                                                                                          Entropy (8bit):3.9461917708957257
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:xK4QRpXWRC+djnY4AZ:UR5WRlY48
                                                                                                                                                                                                                          MD5:DCC85297D2FE96DF8A09D7CAF4CA0082
                                                                                                                                                                                                                          SHA1:0C15BFC8F814DD4308D899D36231EB6D48347E1D
                                                                                                                                                                                                                          SHA-256:035C0F963551A0053772A18B2719100946AE16D12FA6742EC462E2A6DBC5E554
                                                                                                                                                                                                                          SHA-512:69D502C194295C4A279B45F04A2ECF357E74079FBDFE227B14152D036C97258EECB6B64DB30F0E409A9BA6C912A05E7C93A3B7CB359F366C19FDF24D493A5AA8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:|asktao.mod|AutoUpdate.exe|startAsktao.exe|PromoUtil.exe|

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\wdui2.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):760040
                                                                                                                                                                                                                          Entropy (8bit):6.631828546626342
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:IQEZMK46wyPtcHmYJVx7j3Zm66gjxfsEGTG5eKbHepeWO62TrypE/t5CRAsU:IQEZQ9HmK3Y8sE3onpeWO62TqFU
                                                                                                                                                                                                                          MD5:E1223A3CF2E31DC4C39B23D9DDD416D7
                                                                                                                                                                                                                          SHA1:740C4DA3149A78D639663931A13650D641E21B92
                                                                                                                                                                                                                          SHA-256:54D66504718E7783FB2C3D377426763411D75A23C5EA71047A8BB7AF6CB8E36F
                                                                                                                                                                                                                          SHA-512:45410DEFFA6C33D3929DB194EFC514EE1ED946490650995076DC73ACB02213E82E53C045FC69ACEFCA110404ED35A5C2D385154331B58D2E890FE48D670C2209
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z..........0T_.....c\.....IM...........cJ.A...cM...................|...cC.....c[.....I].....cX....Rich...........................PE..L...xY.d...........!...............................................................'.....@..........................r......<W..,....0..4............l..P,...@...a......................................@............................................text............................... ..`.rdata../...........................@..@.data............`...h..............@....rsrc...4....0......................@..@.reloc......@......................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\wdui3.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1011776
                                                                                                                                                                                                                          Entropy (8bit):6.611289121716258
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:ekv8v4JDFERTNPfERcYQzrbO8ETbuVmrrg9R:EwpsTNPsRcYQzfO8ETKVgrw
                                                                                                                                                                                                                          MD5:CC1F831DF0FF4D64E69068701A421D70
                                                                                                                                                                                                                          SHA1:ACD0DD28FBD990296F8EF239403EA1EE2FC00B44
                                                                                                                                                                                                                          SHA-256:C788E5439C0ECCC5D889ED5C94855A86801B27835ADFEA0549F3D9F825AFBBC6
                                                                                                                                                                                                                          SHA-512:98D54BCBE33D4C5DB933782E05048240760BED6BE91F992B8F07148B1A4BA18C9B9D93DD54BF4CD08E537C0DF7B8768DA1467793E6D4D6757CCE54D3414C476C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0`..t.@.t.@.t.@..N.u.@.}y.S.@.jS.p.@.S...u.@.}y...@.}y...@.S.-.r.@.S.;.Q.@.t.A./.@.}y...@.}y.u.@.jS.u.@.}y.u.@.Richt.@.................PE..L....._...........!................xF....................................................@.........................P...M...d............'...........8...7......x.......................................@............................................text.............................. ..`.rdata...1.......2..................@..@.data............\..................@....rsrc....'.......(..................@..@.reloc...............V..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\safemon\wduicfg.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10684
                                                                                                                                                                                                                          Entropy (8bit):7.938219959174158
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:56brFL/ebjiQBn6ayMKk5eQTTiP0QQb1kt/RAuEflVMO877skGdAu:QrF6Hjryrk55TaoafBO877skWZ
                                                                                                                                                                                                                          MD5:BF64E1DBA91A7A7B545EB31CC445F7B5
                                                                                                                                                                                                                          SHA1:18C49F509FC4FB56A8F267C6A993109184447EB7
                                                                                                                                                                                                                          SHA-256:C51C8AB109733500A7EAFCFFBC098F12AF841C2CF958AA4DD9E93CACCAC59CB4
                                                                                                                                                                                                                          SHA-512:BEB1659C2C8E1B5F4937C4A1E0CEF91545C8BD22314C9B003F70575298DA6801AEDE2AD29FC9ED53C661DC2E7EE2DF04293C7A159FD0CFA0602E3C2E9511FBFC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:QHDT................1.0.0.1..........................................................^.................................................................w.d.u.i.c.f.g...d.a.t...............................................................................................................`..6`}.........R......&%...B..W........}.Y\..*.d9.f ..C...UD......H.K,.?B.2..*.......2.&..Cu.....~+.o....5..4Z.@@ ....v4.....&..hE...&.E1.v..S.......&..w.u.......v....Pq.Sz.*.s..r....V..a..%O.?...P.fC..y.l...R.w..mm..e..c.S...pR..n.lk..&]...S&.7a{M..;O..(.ag....{.3}.&>..!_Js..{J..h_........qs...C.C....w.U.h.92............x.k.p..0P..U.......W......a..5....x.D/..6..$\.%f...5../.~.!...6OD1...k8C"J#.i,.........N....qF.Nt\\........U..r...gQ<.TL.q....z.X.?.;`b........s_...........6..... ..7....@..Z.gj.....H+.x.k.6...c...(C....:.~..6.s..6.=c....d.A...K..?;.x..4Pe..}.#........%.H....cP...yT..~.y..Ulvp..2.-...>..v..aJ......I.2c...M....'.....u[.#[0./KL.9.H.d..w..i.c.a..;...'

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\scanbase.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):121224
                                                                                                                                                                                                                          Entropy (8bit):6.5347480881975235
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:gYr/IVanty6TScycy52HOkSlik+hfNTB90:5ecmIukL/VN90
                                                                                                                                                                                                                          MD5:67BA4FA42FEB36323A08978428AB4BC9
                                                                                                                                                                                                                          SHA1:1E6DE7BED8F573490F38CFE014C2E958826ED59E
                                                                                                                                                                                                                          SHA-256:957644DFBD6E73D7AA99F81989F567958146DEA69B9EDF492D1C9C4D59518271
                                                                                                                                                                                                                          SHA-512:590A24BF04A597A801CC97C9F3184B343509976839C1C658465AB79E38F08D1D1DA360802AB4FD511EAD0E16BC6E1530643BA6283E73E8597AF6C4715AFE61F4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.~.p.~.p.~.y..a.~.y...G.~.y.....~.y..w.~.p.....~.y..|.~.y..q.~.n..q.~.y..q.~.Richp.~.................PE..L.....-_...........!................z........0......................................}?....@..........................s..L....k..<.......(................6...........1...............................P..@............0..\............................text............................... ..`.rdata..LC...0...D..................@..@.data....0...........^..............@....rsrc...(............t..............@..@.reloc...".......$...|..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\scanproxy.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):551936
                                                                                                                                                                                                                          Entropy (8bit):6.5502064702439915
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:VwCQqHl9fmgXf62ktbJTFu+j67bGu3vOfKBEiT12DpZHuPjoEtcL8qTqfzqiZD:V4qOaGu3vOfKBEiT12FZHuUEtcLyzqil
                                                                                                                                                                                                                          MD5:ACBD126A6222D1F5EFB729A62649B6DE
                                                                                                                                                                                                                          SHA1:9F10A615EE883C60BB1DAD29D04359427EC587CD
                                                                                                                                                                                                                          SHA-256:907D795E2DFD4A63ECFFBC03A063DC01AB251F497B312A5D749EAD87D141624B
                                                                                                                                                                                                                          SHA-512:9CC8FA6430267FBC8FED4321AE9747343A9BDC0AAD8590FF8C6EFB2F8881DA05F3B0B956370A6EFD3ED76C10F6816F1DECAB3626F42483A2B56CD3DA7E902644
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@)...H...H...H...0...H...0...H...0..LH..#...H..#...H...H...H...0..8H...0...H.......H...0...H..Rich.H..........................PE..L...BsV\...........!.........*............... ...........................................@..........................X..M....J..........(............4..h7.......\..@#.................................@............ ...............................text............................... ..`.rdata..-9... ...:..................@..@.data........`...R...B..............@....tls................................@....rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\scanstub.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):186944
                                                                                                                                                                                                                          Entropy (8bit):6.589261685499034
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:7h20E0JBZIBwcBjLIP1AKHiJQs6TWvJa3hQYkHaq0jSgM5nt0X9R2:Y0E0qFlLiCK3HTWvJcQHaqRgWaX9R2
                                                                                                                                                                                                                          MD5:2B7BEBDFB41F8BC3BDF7BB9EB2280F77
                                                                                                                                                                                                                          SHA1:87CA326ADE01C5114D3FE7EEBE524275F3631A1A
                                                                                                                                                                                                                          SHA-256:A38CDECD4CD697D55658FEC8F0D1680D54C32C6941D9707F3D3FE31A433ADFFA
                                                                                                                                                                                                                          SHA-512:F3254E17D0E56AA7B0B7890776E89DC73DD0191ED40B1C11124E0DF9CE905CC40403FB22F7B222E335C2043DD9FFC5FC61AEA3727B4EF77B22AF1C5560025445
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~..c...c...c.......c.......c.......c...}..c...k..c...c..uc.......c.......c...1...c.......c..Rich.c..................PE..L...@]"`...........!................',..............................................cH....@..........................f..L...d[..x.......(................7......X....................................;..@............................................text............................... ..`.rdata...V.......X..................@..@.data...lE...p.......T..............@....rsrc...(............n..............@..@.reloc..Z(.......*...v..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sites.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1475648
                                                                                                                                                                                                                          Entropy (8bit):6.239535600767825
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:nrpLo6o/c+H8+VR3Nba2nTUQz5Qo4BdfWPW99g:n9Lofc4pn3NNAQz5QBdoWU
                                                                                                                                                                                                                          MD5:D43FA5904A62445893FE1DB320FF2E7B
                                                                                                                                                                                                                          SHA1:2F888949E9C3CE0F647B97EBC8289AE3F2F2EAAE
                                                                                                                                                                                                                          SHA-256:074F19878542B07060BCF7A10238AAC2571EDA75F6596FED6A0A1F7E884F2305
                                                                                                                                                                                                                          SHA-512:1589551E1B5F2C8794F56543EB472C1A801F6DD6B338FFE406BF91BF39061A9022FE13C9A460589A42F243F5329193FF2AE32B1112252FC78D0321C68313B34C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........MM..,#X.,#X.,#XAc.X.,#X.T.X.,#X.T.X.,#X..NX.,#X.~.X.,#X.,"X..#X..XX.,#X..MX.,#X.T.X<,#X.T.XF,#X.T.X.,#X.~.X.,#X.,.X.,#X.T.X.,#XRich.,#X........................PE..L...a.._...........!.....R...*.......T.......p.......................................-....@.................................t...........8-...........L...7...........y..............................x...@............p..L............................text...'P.......R.................. ..`.rdata...B...p...D...V..............@..@.data...8...........................@....rsrc...8-...........(..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360Downloads.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):269
                                                                                                                                                                                                                          Entropy (8bit):4.8581472979091815
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:TMN4y0vC7RJyxh7R+vSV3gIC7RrVBx0H7RpMddLmy0kJ7R13LBn:AkvC78h7w03NC7bBx0H7Pidz0O7T3V
                                                                                                                                                                                                                          MD5:3E30E5B4B1A8353375935A2F468138F4
                                                                                                                                                                                                                          SHA1:6E4E98913060906522765E5F164A20C66BFF6C2F
                                                                                                                                                                                                                          SHA-256:07025E347ABF4495E63A4714BD04EC415D7C1DFDD771619994956271C0E69A05
                                                                                                                                                                                                                          SHA-512:801BA3079FDFCED0621E82058C7C2E5206916C78AF5E5C31500FA26CFC7FD163EBDCDCDC5198491D85C5EA001B4CDD5E314980E5287CAD3401C788171F732BBB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:[plugins]..src0=360Base.dll..tar0=softmgr\plugins\360Base.dll..src1=360net.dll..tar1=softmgr\plugins\360net.dll..src2=360P2SP.dll..tar2=softmgr\plugins\360P2SP.dll..src3=LiveUpd360.dll..tar3=softmgr\plugins\LiveUpd360.dll..src4=PDown.dll..tar4=softmgr\plugins\PDown.dll

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360InstantSetup.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3023592
                                                                                                                                                                                                                          Entropy (8bit):6.5611362501938215
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:eTTMqJcXQv/rsV89JsDGqoh5E7XDiRqKx53OBf/7IIV7cWamXH3Fe31cOduH0Lgm:8pJXsOfEi+Bf/7PbXH3Fe31cOdue
                                                                                                                                                                                                                          MD5:BE18605F193B3F3164FD3D65B9F007BA
                                                                                                                                                                                                                          SHA1:17C1EDD08CC70AAAB24AE49F3438EC2E1896EA3E
                                                                                                                                                                                                                          SHA-256:050B900D2B507A159E62311B16AF83109F85179DA10AF6358422A3F91601DC14
                                                                                                                                                                                                                          SHA-512:2A019437E529CDEAAF65D6CE85C0685EA88323152A2A127F9C140679F12A2E91D14461613B71BEAEA4BAC1A64A03A0D3D4373F534A0663A076D5797E37991D8B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........GM<.&#o.&#o.&#o.i.o.&#o.^.o.&#o.^.o.&#o.t.o.&#o.^.om&#o..Mo.&#o..No.&#o..Xo.&#o.&"o9$#o.^.o&&#o.t.o.&#o.^.o.&#oRich.&#o................PE..L.....[d.................&$..................@$...@.................................%.....@..................................}).......*..k............-.P,....,.p~...K$..............................&.@............@$.p............................text....$$......&$................. ..`.rdata...z...@$..|...*$.............@..@.data.........)..^....).............@....rsrc....k....*..l....*.............@..@.reloc........,......p,.............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360Opt.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):860736
                                                                                                                                                                                                                          Entropy (8bit):6.469985686922261
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:d36I8z6OsHBsRiRh+jqkdz/bLkQmpDmdD7rnZ4x3KpcaUHEkeK7doyFSdU9QlMr:dqV6HB7H5y7W3eUHzeK7doyj+lMr
                                                                                                                                                                                                                          MD5:185087AF06DA6E9AA0D50B9F37B5D6DF
                                                                                                                                                                                                                          SHA1:227EA66FE28C4EB9722FF2A047744CC98561F91A
                                                                                                                                                                                                                          SHA-256:2E7060837DD166E3CB5406C20899C953A2445F57F2872502D0ADFAAF4A025397
                                                                                                                                                                                                                          SHA-512:1CF9F453B313B58A30E971DFFEB3CE4F24AB0B81CEDDA5BD0F99E89A31FBD39E23754302962B28AB94A8C8433B0DFA04FF52AB4679B161432016ADD49A5DD23B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=V..\8].\8].\8]d..].\8].$.].\8].$.]b\8].$.].\8]..U].\8]..C].\8].\9].]8]...].\8].$.].\8].$.].\8]...].\8].$.].\8]Rich.\8]........................PE..L......[...........!................7........ ...............................`............@..............................................................7.......z...$..................................@............ ...............................text............................... ..`.rdata....... ......................@..@.data...Hj... ...*..................@....rsrc................(..............@..@.reloc...............2..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360SoftMgrS.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):445952
                                                                                                                                                                                                                          Entropy (8bit):6.550992964647802
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:+HOH/nbI0od/roaezM6g7CXblJnfCzq/P:+uHvA/kHrlJnKzkP
                                                                                                                                                                                                                          MD5:116C6B61CB9A9C8544B069E27EBE1D06
                                                                                                                                                                                                                          SHA1:469756700FA2D9C610EF271DDF011EDBBEE72B8D
                                                                                                                                                                                                                          SHA-256:A36A4ED1A91FC9A0DB7F6B78E751627EB90FD471BF28E150EC2CD151D5B82DAF
                                                                                                                                                                                                                          SHA-512:8F49043185D8C96D77CA4326F53C5462755DFAC019A1EAE0414EC039E3F8675FACF5436A066CF90BD3FDF30959F5F4939B1AE83430B6D699645023B89CF2A79B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=.I=.I=.I...I?.I4..I$.I4..I..I4..I..I.7.I9.I.7.I .I=.I1.I4..I..I4..I<.I#..I<.I4..I<.IRich=.I........PE..L......T...........!.................r....... ............................................@.........................0................`..<<..............h7......`9..0$..................................@............ ...............................text............................... ..`.rdata..3.... ......................@..@.data....]......."..................@....rsrc...<<...`...>..................@..@.reloc.."N.......P...D..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360elam.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16488
                                                                                                                                                                                                                          Entropy (8bit):5.860197512993566
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Az/0xEfoeFv0Q9uW5CRDWHVWQ4eWjEduXqnajyChd8C:Az/yyTFsyOlmC/8C
                                                                                                                                                                                                                          MD5:DF0C371FA00382885CE796DB06E84C5D
                                                                                                                                                                                                                          SHA1:047DBAEDC7A78E49CAF7450BB045B27A9426516D
                                                                                                                                                                                                                          SHA-256:94B8EFF04D956B055050249550AD276F9AE433C004A2F20AB5C7C769A9A57F12
                                                                                                                                                                                                                          SHA-512:2AAF2AA3454BAD825B10317C32B757D4F484DD6419A5EAF28C523CAE91C98F3F148BC465F021442B20E047E36582324F30EAEF2F517BBD843B85AF6A4D394E66
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$..........[...xC.K......q....,A..D...L..A..yT...#...@j..@'qC...|.)U...p..\l...{.,....h<B[t.;..F.BD....v. .@[(..1....Ro..p.!.ZE.....K^>............................................................................................................................................................................................................................................................`...`...`...`...`.......`.......`..f....`..f.!..`..f....`..Rich.`..........PE..L....K^............................@P....... ....@..................................D....@E................................pP..(....`...................!...p..H...0 ..8...........................h ............... ...............................text............................... ..h.rdata....... ......................@..H.data...4....0......................@...PAGE....j....@...................... ..`

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\360elam64.sys

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17000
                                                                                                                                                                                                                          Entropy (8bit):5.7743142701092065
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:JlI0Ytd9deFvy4GjuW5CRDWHVWQ4eWjMyuXqnajyCMO:JlIltdmF9ryr9lmCb
                                                                                                                                                                                                                          MD5:67E72EE5DCD6E2C69D9C1F457FD0E3C9
                                                                                                                                                                                                                          SHA1:1DA65CA2FD47F10EC7EAC55FDB5BFCE19BB90DE3
                                                                                                                                                                                                                          SHA-256:7F3F8CDE5989C7339F4862DD44ECD827FBF06D0AE6152C17907E27E822E0BF82
                                                                                                                                                                                                                          SHA-512:D715CC1761A025E0DF4296A4C37C4E799C6006DCE6BF63215F9864CF853CC5F7917FD24BAA1CAC775E8B74005EEBB6FC42B211876BF386AF0062364C6EE2FD77
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$..........................................................................................................................................................................................................................................................................................................................................................................................................R............................................R.......R.......R.......Rich....................PE..d...8.K^..........".................P`.........@.....................................3....`A.................................................`..(....p.......@..<.... ...!..........P ..8............................ ............... .. ............................text............................... ..h.rdata..|.... ......................@..H.data...P....0......................@....pdata..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\EaInstHelper.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):135680
                                                                                                                                                                                                                          Entropy (8bit):6.666685893692265
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:EkC27/AQ8nV9IL4lTV7O9TQPdnujXBuwcoLNjhpuxnTxkbDFv:EkC27/AQ8nW9sP2uwpRca
                                                                                                                                                                                                                          MD5:3E963E13C6AB3091E0384DCF4539A03D
                                                                                                                                                                                                                          SHA1:CA2C41403D392950ECA218C5B3A8829D1F842C70
                                                                                                                                                                                                                          SHA-256:F41BFA204E937824BBC509EC0716DF5DF62E174B73070D1FD80D3FB67A23B669
                                                                                                                                                                                                                          SHA-512:2B7BFB9DC0890C815042B03E2F202FE38106D0FAA850CAF9FC0F813E5A60CB5CDEAE5868875D803350AA04CEBD073F9ECD1563443E7A7DB6029DC1812D674A59
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........x.7...d...d...dcG.e...d\.`d...d.q.e...d.q.e...dv.Ud...dZp.e...d.t.e...d.a2d...d.~.e...d.~.e...dUp.e...dZp.e...dUp.e...dZp.e...d.a4d...d...d...d.q.e...dXp.e...dXpXd...d..0d...dXp.e...dRich...d........................PE..L...k..^.................p...d.......<............@.................................{.....@.................................D...........L...............h7.......... ...p...................0...........@...............P............................text....n.......p.................. ..`.rdata...9.......:...t..............@..@.data...............................@....rsrc...L...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\EaInstHelper64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):149504
                                                                                                                                                                                                                          Entropy (8bit):6.494288563718393
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:r7AFygSGRAK0fcea1ZwmDYo+i+zfBjJvV7BuxCu5FttFM:HAJ0fRa1+27+HVue
                                                                                                                                                                                                                          MD5:BEBC39160A8446EC0E9693F5DA3E8380
                                                                                                                                                                                                                          SHA1:9C4A2817429159EB4357EAD9FCA2D07D9D7C3F21
                                                                                                                                                                                                                          SHA-256:EBE911D8EB2D2989BECC8D9A965749E512914FF2BB42F1199E33C2550DA46C56
                                                                                                                                                                                                                          SHA-512:67281F868AAE81017108DBFEA58B882EC32ECA3D6218E87D7ECF6DF6DF170EA62F94E041CBE09BB53D484AF09ACF72D6734110A4C6926CD0728029CCEFDB5718
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......D...............7D............R.......R.........r.......q.................!...A.......A.......................................................R.................|.....................Rich....................PE..d...o..^..........".................p?.........@.............................p.......>....`.................................................x........P.......0..........h7...`..........p...................@...(...@................................................text...t........................... ..`.rdata...Z.......\..................@..@.data...X*..........................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\GroupMaps.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1514
                                                                                                                                                                                                                          Entropy (8bit):3.290555213966837
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:QbnmQ26E+xp+UXN2GZFHuZ7kbtqHIZGokWRDdJ8ia/J/NA0mrlC:0nmQ7EhqN2E1e7kbtqHIZGyBaBlA08lC
                                                                                                                                                                                                                          MD5:DFDD4BC9A2762462F5349A57C17520B4
                                                                                                                                                                                                                          SHA1:CF979329B12407E3A1F97165AC06A08103B3D5E8
                                                                                                                                                                                                                          SHA-256:3A7B02D50F7E80EF358F3B7E9E3EA139BA9292F127DB458EF50BF186694DF62A
                                                                                                                                                                                                                          SHA-512:1B68A85C0931529A3A6DA1DD087FFA7440FFFF3D2260B1BADD302B796913EB6CA51BE5EFF027E6C88A1C350FCB3724461BDA16A077C59CFE5CCA417104F3A163
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:......[.e.n.S.y.s.t.e.m.P.e.r.f.o.r.m.a.n.c.e.].....I.D.S.=.I.D.S._.O.P.T._.1.;.I.D.S._.O.P.T._.2.;.I.D.S._.O.P.T._.3.;.I.D.S._.O.P.T._.4.;.I.D.S._.O.P.T._.5.;.I.D.S._.O.P.T._.6.;.I.D.S._.O.P.T._.7.;.I.D.S._.O.P.T._.8.;.I.D.S._.O.P.T._.9.;.I.D.S._.O.P.T._.1.0.;.I.D.S._.O.P.T._.1.1.;.I.D.S._.O.P.T._.1.2.;.I.D.S._.O.P.T._.1.3.;.I.D.S._.O.P.T._.1.4.;.I.D.S._.O.P.T._.1.5.;.I.D.S._.O.P.T._.1.6.;.I.D.S._.O.P.T._.1.7.;.I.D.S._.O.P.T._.1.8.;.I.D.S._.O.P.T._.1.9.;.I.D.S._.O.P.T._.2.0.;.I.D.S._.O.P.T._.2.1.........[.e.n.D.e.s.k.t.o.p.E.f.f.e.c.t.].....I.D.S.=.I.D.S._.O.P.T._.4.1.;.I.D.S._.O.P.T._.4.2.;.I.D.S._.O.P.T._.4.3.;.I.D.S._.O.P.T._.4.4.;.I.D.S._.O.P.T._.4.5.;.I.D.S._.O.P.T._.4.6.;.I.D.S._.O.P.T._.4.8.;.I.D.S._.O.P.T._.4.9.;.I.D.S._.O.P.T._.5.0.;.I.D.S._.O.P.T._.5.1.........[.e.n.F.i.l.e.S.y.s.t.e.m.].....I.D.S.=.I.D.S._.O.P.T._.8.1.;.I.D.S._.O.P.T._.8.2.;.I.D.S._.O.P.T._.8.3.;.I.D.S._.O.P.T._.8.4.;.I.D.S._.O.P.T._.8.5.;.I.D.S._.O.P.T._.8.6.;.I.D.S._.O.P.T._.8.7.;.I.D.S._.O.P.T._.8.8.....

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\Optadn.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9528
                                                                                                                                                                                                                          Entropy (8bit):7.862005954657962
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:FmEAGkgBFbrGUZMONCGt9MsadFfGyKG9Uz/HNGE5p4E5p9o9x2ro9x2Av:YPGkgj/GUyO0GtWDd6G9UxGuGuDov2rI
                                                                                                                                                                                                                          MD5:7F46201B6F4D079420A257190FFB4832
                                                                                                                                                                                                                          SHA1:74D5BA9421CDDF557C6F9DA1F1A152B7BA2194BB
                                                                                                                                                                                                                          SHA-256:324035491E916F87465256F7C7F42E3F9F4A7E56FBA8F9938F0415031583CEE5
                                                                                                                                                                                                                          SHA-512:8A7A0384D8471E32CB8689B2D5EEDE9D3FABE967F9B1092565AEB35EE49726A00B19819780E07AB0BDD42A404CFBF9F6EAE78610E1F4CE578A2BE83698D667A1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:8.Ah..R....~.".=.ae]D{.pI...m..)....#.z$.[.3..}O.i:.....rO.Ce.:......q......N.0.<g#..z.X*?Qvf..N.....A...R,Qg#.F.S.w.9.?...b...OA.....0..a...g...9.$.7..k...eb*.F..'.{.w`..k.`..M.8.O-...w.`.2...0.D.H.W...i.W..a{.%'...M7y%....Y..t...a....s..B..._4v..9..Pr...* !{^cz...;.....k..T.d..n.!..'e.&...T..mNa...)..]....@-L..d.B..l.Q.I....@...@......A$k...9..1ZP....}.k..].[.90.Y...9.0..3}..1.o.#,.=.....&b..F..aw. b.."^k.,...a...jT.\.I..H.sG.rO.Ce.:.A.}......D7.2.........mNa...)..]....@..V.)..L...{3#..it....(....D7.2.........j.$..sW...i.W.......u.M5.........j.$..sW...i.W..a{.%'..:[.OU../..i.$..]....l...<......j...@/.!-H.@.W...z.IM..".X*.....a{.%'..:[.OU../....v ....T.d.....L.....R.A..2xqT}j....'...y...T.d..D....I......0l...aLs=x..j.$..sW...i.W.:.C...]eON...R.v..q.W..!.R[.h>"....l...<.......p.F...-H.@.W...z.IM..".X*....:.C...]ev?c..D.x.rO.Ce.:f..M..x.".....d.j.$..sx.s..W...Thwb|..=.ae]D{.Yg_.c%...K..|L......t..E_YPG...^..`..|..Ae.~O..w..s...Z..&.!

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\OptadnNet.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11320
                                                                                                                                                                                                                          Entropy (8bit):7.92445727605535
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:E60NZz5IE0NnPpulzX8C4bPsIl60NFsCE360VXaCbfBTlzg6Z6pC/j2UCPm6ZKsC:k55yhu+PsIXFsdVXXf5lIwyvC
                                                                                                                                                                                                                          MD5:8D603D135EA5B59B2D980DC704BA4BD9
                                                                                                                                                                                                                          SHA1:40FEA323A7ED4BE1FA0D1014DF431408600AC443
                                                                                                                                                                                                                          SHA-256:444C62B6995A1DE7855B545B2FC922FC200D454AF8D4719261352685DAEBBFA1
                                                                                                                                                                                                                          SHA-512:0D7850ED22E29D78E2DD93F6D61E9C2AB7F13ED45AA45DD1A04005C24BCAE203E9581D8917B680CB59726BB68E2D18CB504FAA7BA4B0347DAC2A5A43916E97E0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:*P......^sPp.n.E...._...kB.E.R..Y?.VL.;0.. ..9F.x.w..9j.......:}1~.......g.cI<.........e..fq.....+._em..{=.h....5].l.D.#8LG..q...l@.7.M.HM="o...D..K.,..........ZDn.YO.M.nv.d.....b.d.8Z.A.@....!S.ce..K......q.F.0B8...n..e...}k.r.....J."........be4.^.........g..d..G..<.?..........f/.K......q.3. ..".h..."g..q`[n. ....m....TQ.'..$....7-.+.uS....T.g...6...|.-.6i.:...9........]....-......5..Q....:B.n...~..RJ.>s..WBtNn.xZ.8...L.rIb..A.@.............q ./..K......qJ............s..o......p...MoR..../..S7R.x.......Q...Sn.m......l......*....5.;I.c.:......:.2x$x...u...}.R[.."...JM.X.&..?......e...Ui....Z.5.S........7#....f....]|.|lS......Q.;+_.....T.......9..@.<.8.......j.^.]qf..GZ...SP.8X..L.=.dZ.q*.....I..:..)..Y.&......{J]..bM.T.s..~.w...0....b...G.7.....O`..c..hKJ........=......Sj].TQ.'..$....7-.+.uS....T.g...6...|.-.6i.:...9........]..h.#...5..Q....:B.n....!.x.........(.Zy..<...{.*},.....]..3...}`..5..h..UU......<H".n=.].E....9...0...H

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLCore.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1892248
                                                                                                                                                                                                                          Entropy (8bit):6.686852443043234
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:DyZdTwgn8EHTD9/CWvZ3ZJ9exT/zO9n/Ge:DM+EN/CWR3ZJ9e2
                                                                                                                                                                                                                          MD5:0149D019C707BE80605C8E1DF3F376E2
                                                                                                                                                                                                                          SHA1:F0CF7C3F8D3E4595C0490CE1DAE1AFA253458A61
                                                                                                                                                                                                                          SHA-256:F2272E34C87AD953BC21487B68AF0FE4C8B7DD1E54B51DC903C1A03744349610
                                                                                                                                                                                                                          SHA-512:84380EB4A3D171990D21B66B791FD3E871B2FCA72957287D0FCAC3FD9FE3C1AA12140B3517115172DF8A17C13B183B9D844CEB5CBDCB00BDBDFE9E5E43592D4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........c..0..0..0.$0..0.20..0...0..0...0..0..0..0.50..0.;0P.0.#0..0.%0..0. 0..0Rich..0........................PE..L.....(c...........!.........|.......B.......0............................................@.........................P...p.......,........................I...........7..............................HD..@............0...............................text............................... ..`.rdata.......0......................@..@.data...............................@....rsrc................B..............@..@.reloc..RH.......J...J..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLHelper64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):154584
                                                                                                                                                                                                                          Entropy (8bit):6.389069056964329
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:TtxaFrwK/1uTuZ75FzHzDSPq56/pakRUkIFujW:T6rwajZ75hHw/Ux1
                                                                                                                                                                                                                          MD5:307208EFBF8A7D1706E45C2DCDFDCE6D
                                                                                                                                                                                                                          SHA1:8997863875B046D5A0EF6DBBC5056A72CCE9A898
                                                                                                                                                                                                                          SHA-256:3B47940BD8DEAEE7449BD14832440567FA47B2003891156359B82338E56076F7
                                                                                                                                                                                                                          SHA-512:A1F55F3E1B01428A41BBD2B7508259F3091C3DCA1A97C63C1A65D7DB548B9044B565AC34867CC1375BCACF58D15980C510254DB2869FEF23816A1D43539273D2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G...&.].&.].&.].^q].&.].^g].&.].^v].&.]...].&.]...].&.].&.].&.].^x].&.].tf].&.].^c].&.]Rich.&.]........PE..d......Y.........."............................@..........................................@................................................. ............h......p....,..@/...p..H...@D...............................................@...............................text....-.......................... ..`.rdata...V...@...X...2..............@..@.data...x=..........................@....pdata..p...........................@..@.rsrc....h.......j..................@..@.reloc.......p.......$..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLLauncher.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):203264
                                                                                                                                                                                                                          Entropy (8bit):6.518309864828699
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:XQ8AwxOkvZxJSdHeIx0vhLeKcE07dlti855J5AyvszFV:Xf2kBelx05LeXrlttF8
                                                                                                                                                                                                                          MD5:3AEAB7472297A1B05F9852863C140777
                                                                                                                                                                                                                          SHA1:3FDC9F7D86139749B0829D594C9122B5EFD37489
                                                                                                                                                                                                                          SHA-256:A035247743BD81B12FCA86C14547127FA2549600BF7226669D13559292C500E9
                                                                                                                                                                                                                          SHA-512:94EE4F51454079C5DE2A00DEC9E71BC7FA2D9F1AE0440443100AA73C4F44DCED08ABB7FD960E9918EAE7112D578B0D30C5DF062D490A6D74A8AD6A0663AF3FF5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1u.9u..ju..ju..j|l[jo..j|lMj...j|lJj3..jR.jw..jR.jn..ju..jG..j|lDjk..j|l\jt..jkFZjt..j|l_jt..jRichu..j................PE..L....Q.[...........!......................... ...............................@............@.............................................................h7......L...P#..............................pj..@............ ...............................text............................... ..`.rdata...p... ...r..................@..@.data....K.......*...~..............@....menu_sh............................@....rsrc...............................@..@.reloc...........0..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLLauncher64.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):234592
                                                                                                                                                                                                                          Entropy (8bit):6.317850492164592
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Yefple/yMkOVOYoA/F+K5EKR3e3scLuFZPE:YkklVOYzt+KR9XZs
                                                                                                                                                                                                                          MD5:A12EB83908BFA8EE4986CB2E83821309
                                                                                                                                                                                                                          SHA1:2B324EE7795E92C393F6986DB53D1CD288B51037
                                                                                                                                                                                                                          SHA-256:8AC85393F4A48136F6CDAAB2F34CD2080BCCC1FB71A0CCE9D37BBDBCBFA7DE76
                                                                                                                                                                                                                          SHA-512:A0475DB552B3A4C83E1FA66656E576E7AAC7767616644E987E2B1EDB8D6D384B5A9C44FC0E9B8FD65F49BBE8878D69D56791AEE6D4FA28D64D78DB6FB577B6C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......; .k.A.8.A.8.A.8v9.8.A.8v9.8rA.8v9.89A.8X.|8~A.8X..8~A.8X.j8dA.8.A.8P@.8v9.8bA.8v9.8~A.8a..8~A.8v9.8~A.8Rich.A.8........PE..d......Z.........." .....P........... ....................................................@.............................................f.......................( ...^...5...........f...............................................`...............................text....N.......P.................. ..`.rdata..v....`.......T..............@..@.data....f.......&..................@....pdata..( ......."...(..............@..@.menu_sh.............J..............@....rsrc................L..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SMLProxy64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):255400
                                                                                                                                                                                                                          Entropy (8bit):6.22607183932509
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Ea0HGWFEqe+UnpsU4CXRXt6GaeWcAMtpp:30mkUnps4Zt6ned
                                                                                                                                                                                                                          MD5:34335C42F2EFB00381FBABE5C0CA90EC
                                                                                                                                                                                                                          SHA1:FFFA158B86FA1FEEA5D87745BEA2744EFE43E09B
                                                                                                                                                                                                                          SHA-256:D2995B2EC2E1DA5925FB2F6458E7837CE68DE8953A131DF89CF2D89A08A47F65
                                                                                                                                                                                                                          SHA-512:F8B0E884D6F118693380722EAEDE20AFA21FCD8D336738CD0F7E0B8E77CCC4C7460FE2345235C1C863DD3AADA1D6A89BBCEC5CB74B60558487C409566E602E18
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7\\TV2.TV2.TV2.]....V2.]...XV2.]....V2.s._.UV2.s...UV2.s.I.OV2.TV3..V2.]...MV2.J...UV2.]...UV2.RichTV2.................PE..d....'.W..........".................4..........@.............................0.......Z....@....................................................P....P..4....0..\........5... ......p4...............................................0...............................text............................... ..`.rdata.......0......................@..@.data....a.......$..................@....pdata..\....0......................@..@.rsrc...4....P......................@..@.reloc..\.... ......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\Skin\SML_SpeedNet.uiz

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):171612
                                                                                                                                                                                                                          Entropy (8bit):7.488297907805019
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:fBn7v+CtIEhUp0EyoJwMWtEh5CcQh768J+uJrOraW:fpT+NEhDEylMWt0VzX
                                                                                                                                                                                                                          MD5:2D5CED1AC751FE7639831AC4C1E64094
                                                                                                                                                                                                                          SHA1:D9221F2100DCDF9B48C6E4E3A359F72CDBE60BE5
                                                                                                                                                                                                                          SHA-256:71DD3802730DD35088A11A7F36374A1C52AA746F44D38DCBC42593435E22148C
                                                                                                                                                                                                                          SHA-512:2860130B71C41893A6FC6B3A11336A844F84CBBE8FB568181BFC079AB490E9F52D7C11723AFFB31C8D88229A7D59089E856E85A81DD2D5DE2D6B356883F42330
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........`.0Qs...[...[...!...BrowserNavWnd/additem_default.png.PNG........IHDR...d...d.....J,......PLTE...........IDAT8.c...`...Q@W...x...P.u....IEND.B`.PK........`.0Q...#[...[...'...BrowserNavWnd/additem_default_night.png.PNG........IHDR...d...d.....J,......PLTE....:>.....IDAT8.c...`...Q@W...x...P.u....IEND.B`.PK........`.0Q..X.[...[.......BrowserNavWnd/additem_hover.png.PNG........IHDR...d...d.....J,......PLTE....L....IDAT8.c...`...Q@W...x...P.u....IEND.B`.PK........`.0Q..#[...[...%...BrowserNavWnd/additem_hover_night.png.PNG........IHDR...d...d.....J,......PLTE...z......IDAT8.c...`...Q@W...x...P.u....IEND.B`.PK........`.0Q..G.............BrowserNavWnd/bg_trans.png.PNG........IHDR.......F.......?.....PLTE.............................tRNS...>j=a.CA...ZIDATh...1..P......~A...BM...._....7.y.r2.%%~.."W......?5...................lx9Rdj..V.m<.!....'X....IEND.B`.PK........`.0Q....`...`... ...BrowserNavWnd/black_trans_bg.png.PNG........IHDR..............G.N....PLTE....z=.....tRNS..^

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\Skin\SML_TaskBar.uiz

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5235
                                                                                                                                                                                                                          Entropy (8bit):7.163102446053801
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:579FOp+gEzkS0n3pW7B6Jstfta8ooOJNuO0EXOw1k5YoRN1M:hOFEzk107BVjONf+Z5Ysc
                                                                                                                                                                                                                          MD5:BCA992D83C8618FB41027E3CD660BB9C
                                                                                                                                                                                                                          SHA1:B39981E572D907A2AFB6BECF4534F5C7E4369257
                                                                                                                                                                                                                          SHA-256:4A7196870602F719E4E560AD52202A8E1FBD6015066B5240670B176203E70355
                                                                                                                                                                                                                          SHA-512:F0ED7392C77560BF5C2E665D40C18E200789D567E11432CF9F2414012057C90E2408C63356AE3F20F03BC66117F8690CB6FFA6FB686FB00A631CF42FEB2C67C8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:PK........B..N...{d...d.......TaskBarBtn/bkg_trans.png.PNG........IHDR.............S.......PLTE}}}Ov......tRNS........IDAT(.c...`.........h....IEND.B`.PK........B..N...............TaskBarBtn/main.xml.<?xml version="1.0" encoding="utf-8"?>..<UI version="1.0">.. <CTaskBarBtn Name="XTaskBarBtn" Border="0,0,0,0">...<Children>....<CTaskBarBtnContainer Name="TaskBarBtnContainer" StackType="1">.. <Properties>.. <Background>.. <C360Image DrawType="1" File="\TaskBarBtn\bkg_trans.png" TileRect="10,10,20,190"></C360Image>.. </Background>.. </Properties>....</CTaskBarBtnContainer>...</Children>.. </CTaskBarBtn>..</UI>..PK........B..N.9.............TaskBarBtn/TaskBarBtnShadow.png.PNG........IHDR...<...(......ei.....PLTE....................................................................................................................................................................=A...6tRNS..............#.(......a62...@.jM.R:.W..F....u\o{..U.......IDATH.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SML\SoftMgrLite.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2438208
                                                                                                                                                                                                                          Entropy (8bit):6.448789804104688
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:lzfHoM2UyTx0TPb3mazHOu8YADoFPDHH8ZncCowD:20Tj3mazHMD2C
                                                                                                                                                                                                                          MD5:6439BAAB2C61892FC2669B4322D7CC71
                                                                                                                                                                                                                          SHA1:8DAF55A68296BC322E62A0AACBE819EA22470638
                                                                                                                                                                                                                          SHA-256:C594D3875BDC99625D12CE534E4AE17C38A17647F243F9463089EAC68DA96E8F
                                                                                                                                                                                                                          SHA-512:A76DA2664B07208D51B5567FC48EB595B7D6CC2C46602386046CD3306A1B145E7959DA9CA2E5E9932A514CCC0E3291562C48AB871B2C3A416C3180A06D29137B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........*.~.y.~.y.~.y.,;y.~.y51)y.~.y..*y.~.y..<yK~.y...y.~.y...y.~.y.~.y.|.y..;y.~.y..5y...y.,+y.~.y...y.~.yRich.~.y................PE..L...AL"`.................N...................`....@...........................%......'&...@.................................|.!......p".<.............$..7...P#.l....n..................................@............`..h............................text....M.......N.................. ..`.rdata.......`.......R..............@..@.data...p....P!......@!.............@....rsrc...<....p".......".............@..@.reloc...$...P#..&....".............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SomAdvUtils.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1071168
                                                                                                                                                                                                                          Entropy (8bit):6.562408646743628
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:YygvASnoyXXwIZCVJXHCZTVM4K/Px+b9SX5rqWGx9K:K/oyXAI04VMp/JuMXnGa
                                                                                                                                                                                                                          MD5:02CD5DA348F0133D810CE5C3F58E4428
                                                                                                                                                                                                                          SHA1:9B57598D711F7E879EE9D46467C6371EE81D8AA5
                                                                                                                                                                                                                          SHA-256:A25789FE20D207FAC96BBFCCAF6338AF7F4DDDDEF6CF9AAA1855ED8B083B0F24
                                                                                                                                                                                                                          SHA-512:D0FC9F23AB07FDED195F428956820A7E58046ADB1451D4130A7E310DD9697D95F800540C02E1E3258084F97222DF03070D7667B11088352B377B2C9EBD6A967A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............rW..rW..rW...W..rW...W..rW...W..rW...W..rW...W..rW...W..rW..sW..rW...W..rW...W..rW...W..rW...W..rW...W..rWRich..rW........................PE..L...i(7`...........!.........&......,.....................................................@..........................A......D)....................... ...7......0....................................*..@...............X...|&.......................text............................... ..`.rdata..Q5.......6..................@..@.data....i...P...,..................@....rsrc................Z..............@..@.reloc..............d..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SomAdvUtilsWrap.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):478304
                                                                                                                                                                                                                          Entropy (8bit):6.529673824574985
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:lSVQ04jEKRhv+R6OuOTy2odnlRE6dnSGiUR9Nt74o:xFf2o/RPSGiG9NZ
                                                                                                                                                                                                                          MD5:A2A1326EDC3B6C489A7814903D8F7458
                                                                                                                                                                                                                          SHA1:075402303C92660800EA40ABA8B4A56AA397E5D1
                                                                                                                                                                                                                          SHA-256:ED7A3C85CB3DDB071027E7CE35EBFFA057087AC07E02A56D9105DF19BF6040D1
                                                                                                                                                                                                                          SHA-512:2848B6DDBB78195D2AD37644D9F55A19366ECF4BD2A42A8309C309CA93FA505CBD2235FC4B04B4D05C07E2CD19B6B25BDE3CA54D132CEABD167076DE6BD456A1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.................(.......>.......9.Z...5a..............7.-...../.......).......,.....Rich............................PE..L.....^Z...........!.....6...........I.......P............................................@..........................T..:....E..........8................5......0N..0S.................................@............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data....v...`...L...B..............@....tls................................@....rsrc...8...........................@..@.reloc..F{.......|..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\SpeedUp.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):194672
                                                                                                                                                                                                                          Entropy (8bit):6.509126524607204
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:X6vyXhp2+VUmM34QLjh261CieiMQHcCC2xPzphkD5DXt1I5ta15zd7d:XlPqbniierV2pz0TPoKdB
                                                                                                                                                                                                                          MD5:F8CF708F7E4AD1DD501718AD219A139E
                                                                                                                                                                                                                          SHA1:057C7B2C5170984138BF9DBCA7A3D109E4E85BC1
                                                                                                                                                                                                                          SHA-256:834F7262204DE241B786E65ACD2D51ED2C3D1F04639134E0BC89C0AC5D68CC91
                                                                                                                                                                                                                          SHA-512:F7BBE5D4CB79BFACC0F75FDE914169FC732F999FD1DA1B5EA3719643541DEFA54B63F3B1A6611647BDD2C53B5DFF599872C8FB97FDE8AE59FE2FDFC4E456B74B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Hm.....\...\...\.tp\...\.tf\q..\+.\...\...\...\.ta\;..\.to\...\.tw\...\.^q\...\.tt\...\Rich...\........PE..L....RTU...........!.....(..........(9.......@...............................@......i|....@.............................l............................................B..................................@............@...............................text....'.......(.................. ..`.rdata..li...@...j...,..............@..@.data....J..........................@....rsrc...............................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\commonbase.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1761704
                                                                                                                                                                                                                          Entropy (8bit):6.756879419120084
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:njmq2wFkyVGnYIBj7h3oo43hrkg0TYT7a5l3C:329yiXBxq3hrkoaLS
                                                                                                                                                                                                                          MD5:C33AEA70EEC7924564E91A21C060F82C
                                                                                                                                                                                                                          SHA1:91C21BCC38DF1BC3AD91629ECDB8921F00DE9495
                                                                                                                                                                                                                          SHA-256:CF8FDE466611A9DDA3A335071255A56ADE1D7BD47999CAF48588EF4498D8E92D
                                                                                                                                                                                                                          SHA-512:CBC301C7000B8F8CF472C50D0D9526741F8FB86481EF0EEEEA5A14B78A350388B875E95A2575539675038196C81BF59DD38177DC5670DC1444920177AE0C6532
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f.II...I...I...@.P.o...@.A.....@.F.....n...N...n...j...I........'..@...I...Q...@.O.<...@.W.H...WUQ.H...@.T.H...RichI...........PE..L... .[X...........!................vR..............................................$<....@.............................r...h............S...............5...........................................................................................text............................... ..`.rdata..r...........................@..@.data...$...........................@....data1...............:..............@....rsrc....S.......T...V..............@..@.reloc..|...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\data\SoftDetect.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9577
                                                                                                                                                                                                                          Entropy (8bit):4.015893803028424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:g8fHYUTpyIpBU5yct+GpKR6+WBeugMvPpCn8dpG9:jYoybKR6+UxxQ6G9
                                                                                                                                                                                                                          MD5:3F23AEB682DD8B91E8FEA63898D1C1CB
                                                                                                                                                                                                                          SHA1:A71850C0EB4F8C9952056E4221E3E97310955E84
                                                                                                                                                                                                                          SHA-256:869F2823FD36E124084F1FFED596E820FD49204AEFF49EE577C763110BCB4AA9
                                                                                                                                                                                                                          SHA-512:152048F62F84ACA24E732DC0C2B3E1FC6D512D4C8C4806306206E7A74542ACC297BEA5E32A18163D7E8D58D32471220CF895AD4C45E8FBDAB0449A1345D71A36
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:NXF...................I.D...N.a.m.e...F.l.a.g...D.e.t.e.c.t.W.o.r.d.A.r.r.a.y...D.e.t.e.c.t.S.t.r.A.r.r.a.y...V.e.r.R.a.n.g.e...............*.......Opera.................^...Software\Opera Software...Last Stable Install Path.........launcher.exe.............................'.+.C.......Adobe Flash Player.{...........................;...Adobe Flash Player ActiveX...............................;...Adobe Flash Player ActiveX...............................?...........C.?.....Chrome.......I.......................J.........d...Google Chrome... .Google Chrome\Google Chrome.lnk...chrome.exe.....chrome.exe.....................Y..... .Google Chrome\Google Chrome.lnk...chrome.exe...............Google Chrome...........9...Google Chrome...........chrome.exe.....................k...........*.k.....Skype.................?...SOFTWARE\Skype\Phone...SkypePath.............................P...........).P.....LINE.................%...LINE...............................b.........#./.b.....VLC Player.........

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\lockkrnl.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):367728
                                                                                                                                                                                                                          Entropy (8bit):6.5203250769589545
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:3lfIt3gJi9OuMNZKnA0nsKnBPOqudUyNtWe3tNBcPrAGl2Y:1wt37ONZ+lBPOq5yL13tNWL2Y
                                                                                                                                                                                                                          MD5:263E9CBEC0B12B28F37B99FA855B1BAD
                                                                                                                                                                                                                          SHA1:8A51FF5D5948AC2CEC2997FF54B6BF67EA7E5A45
                                                                                                                                                                                                                          SHA-256:9FC9F2A6E341005CAC55975C1F07D10B3634A407EC3ECC1148DC879509F1BCFB
                                                                                                                                                                                                                          SHA-512:BB1B9A50A42F6A9D8185D6B2583C25ED617D1823CAEC470F6EA3903E04D405E35B6E43838AD37D4148A3C6814CC948D04A58B9FA60D2C8BE1EEB910246C9329C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7.o.7.o.7.o....6.o.>...%.o.>.....o.>....o.>.....o.7.n..o.>...$.o.>...6.o.)...6.o.>...6.o.Rich7.o.................PE..L......T...........!.....b...........^..............................................x.....@..........................8.......*...................................,.................................x...@...............x............................text...G`.......b.................. ..`.rdata..a............f..............@..@.data....D...@....... ..............@....rsrc................:..............@..@.reloc..bA.......B...B..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\optconfig.ini

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2122
                                                                                                                                                                                                                          Entropy (8bit):4.289784020268058
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rvDDEmpUqeDeOd+mfXh38iHVDgc6bDKvCC+o1:rvZpUqDOomfN8UVDgU++
                                                                                                                                                                                                                          MD5:1F25495AD4A389C347DC028019C68EA7
                                                                                                                                                                                                                          SHA1:5C281C3C470A14E113FB60E01526D5F857C36BDE
                                                                                                                                                                                                                          SHA-256:D3D426943AB5DC1F2CF0D7C4194589B668E8621D62420B0C726A033B2D961AF1
                                                                                                                                                                                                                          SHA-512:581920F3CF19B9E2DB848D4580BAA35E8B294503A6E371B4E004BFC7ECA3462E21E746544D50775057C6F8B4F2C855D171CD7532310CEF307ED9ED60B99B920F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..[.o.p.t.].....f.u.n.c.c.t.r.l.=.5.0.|.0.|.1.|.2.|.4.6.|.4.8.|.5.4.|.6.0.|.6.1.|.7.1.|.7.4.|.7.5.|.7.6.|.7.9.|.7.8.|.8.0.....r.e.c.o.m.m.a.n.d.=.0.|.1.|.2.|.3.|.4.|.5.|.6.|.7.|.8.|.9.|.1.0.|.1.1.|.1.2.|.1.3.|.1.4.|.1.5.|.1.6.|.1.7.|.1.8.|.1.9.|.2.0.|.2.1.|.2.2.|.2.3.|.2.4.|.2.5.|.2.6.|.2.7.|.2.8.|.2.9.|.3.0.|.3.1.|.3.2.|.3.3.|.3.4.|.3.5.|.3.6.|.3.7.|.3.8.|.3.9.|.4.0.|.4.1.|.4.2.|.4.3.|.4.4.|.4.5.|.4.6.|.4.7.|.4.8.|.4.9.|.5.0.|.5.1.|.5.2.|.5.3.|.5.4.|.5.5.|.5.6.|.5.7.|.5.8.|.5.9.|.6.0.|.6.1.|.6.2.|.6.3.|.6.4.|.6.5.|.6.7.|.6.8.....h.i.d.e.=.4.6.|.5.|.7.|.3.9.|.4.0.|.4.1.|.4.2.|.4.3.|.4.4.|.4.5.....b.a.n.=.2.-.1.|.2.-.7.....n.o.c.h.e.c.k.=.2.-.3.........[.W.i.n.1.0.O.p.t.].....n.o.c.h.e.c.k.=.1.|.2.|.3.|.4.|.5.|.6.|.7.|.8.|.9.|.1.0.|.1.1.........[.I.c.o.n.H.a.n.d.l.e.r.].....e.n.a.b.l.e.=.1.....p.o.s.t.f.i.x.=.x.l.k.k.v.d.|.d.q.v.|.d.s.k.|.b.f.l.n.k.|.b.v.d.|.b.f.d.|.d.o.y.|.s.p.r.........[.C.o.p.y.H.o.o.k.H.a.n.d.l.e.r.].....e.n.a.b.l.e.=.1.........[.d.i.o.].....b.t.i.m.e.=.5.8.0.0.0...

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\safespeedboot.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):53389
                                                                                                                                                                                                                          Entropy (8bit):7.997366381400626
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:768:exSwZplWtYefRs4u19bV1golQVTAEGUr5jo5oj3Bf9I2YnH0cfq7rHxsWlBirkxq:WWYyNQl8tAT4jIw0/n+7ruWlErumZ
                                                                                                                                                                                                                          MD5:C5C819B1E32B2D044B64DF126067F6B8
                                                                                                                                                                                                                          SHA1:518ADF88F72BEB4FDC39297E1E6C6D9F16A78668
                                                                                                                                                                                                                          SHA-256:097410028D300AEC85BDE70806E396E7637E97429011DB486E545D5F2FD68DBA
                                                                                                                                                                                                                          SHA-512:62F48A76C628B8A2AEB125E48548FA8127E1BDD467B3F75F7AF6E32330ECE6E92B17F13BB7C957FA990A7886C50E870299605096AE34491006D12AA8A3CCBCBE
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.p..t.@..,.,.q....`...E....S.)p .fJ....zG.t.N...V-.B.m..3Fk.h..j......p8.$}...-.J.S.n...k..&...#0.@."QZ..b!....%z(.W......8Ol..C.|C...~..).. x ._!..b..0b.+.[..%..yB..1.B...?,.d.>5v..F..d<...,.e..9.T.q.U...l..?..6f2.M..|.[...&w9.D.H...'w.,.v....#.\......j9._!.l.5.]?. WT..+.T....F.r..#.P.w9.N..k.x ..r..4.O...4).o.;Ns..I..k7.H......<.#V[..(.k....E.s..".Q.v6.O..z$.z..). uF..j...3 .P.2FSX.g.._...Q%.e.f/.....u......G..i...b..-......I..hQ..k(...a6..+._=."QZ..).j....D....-.N.u7.L..d..\.{.......,[`.._.`....r.....D.c-.B..n..V......g........3.E.!SfK.H..J...F:.C..u0.H..f..?M.1...7.....x...SR...O..../:...<..}...~.\..q.T(.qC.6.X..t...!R.f..0Aj.i..m......w9.T..p...!r&._+.k...g..?|R.s..S...n..9..0h0.O..r.[..h...t$.E?.e.m1.S.F$...q...p....9.Z......p'.Q$.r.*.\.0.V..{...$W.a..7Bo....n......t4.q..2.@...g..?|R.s..S...n..9..0h0.O..r.K6...l.....8Ol..C.|C...~..).. x ._!..b.m=.G.H..f...>.Y.Y\...u....,...6..gD..p3....g....P......4Ch..G.x....z.....|$.[%

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\softmgr\somkernl.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3360584
                                                                                                                                                                                                                          Entropy (8bit):6.707905762445899
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:YZMkQxMeXqSbbkZFtrLeXfVxCB38JQzAwi9rexOFpQmMx6Zumaww7mIolLHoJ772:YZYbbkZLJ8KAJ9y6amM8X1Hu77ugBw
                                                                                                                                                                                                                          MD5:DD7F41B9EE99C324D20C17694F9E141E
                                                                                                                                                                                                                          SHA1:F4C56CF3EA028561EFBB6CFBA44FFBF2487E9513
                                                                                                                                                                                                                          SHA-256:235FB32D2CBD7C61E9A0DDF1A9693E6614BCC2654FC48BAE65A2478797B43CDB
                                                                                                                                                                                                                          SHA-512:635C64E55120157C999FA04651853E856BA6AA3A92C3A4ADAFBFF5D29F96F703D8A90F0691346B055AF3A41B0E476F396CC77FE37EE1A240FB766C0380BFF6ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........FK..'%..'%..'%.qh...'%.._...'%.._..#'%...H..'%...^..'%..'$..%%.._...'%.0.7..'%..'%..'%.._..2'%.._...'%..u...'%.._...'%.Rich.'%.................PE..L...%q.]...........!.....l'........."*#.......'...............................4.....:l3...@.........................../.........|....01.L.............3..6...P1.d.....'...............................................'.L............................text...yj'......l'................. ..`.rdata........'......p'.............@..@.data...d...../.....................@....data1........1.......0.............@....rsrc...L....01......80.............@..@.reloc..*....P1......V0.............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\360FastFind.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):232008
                                                                                                                                                                                                                          Entropy (8bit):6.630006002990767
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:kcUTb3+ZC842kctXc35QMKwnESS7nNKlPQLM/8aLhqI6eNWHMtEQKOKxn5rnONc:Gb3kZk2XI5QMx6MZ/8atq5eAsiPbxD
                                                                                                                                                                                                                          MD5:05A04412B0A86F848EB92A97E81F3821
                                                                                                                                                                                                                          SHA1:A6495836BB9915EEC2C559077A44861D2C5C8182
                                                                                                                                                                                                                          SHA-256:45A9D2180BC3A6C5716A5CCBF74B14D9E91FA706449AAE4046C0835CC672F5E5
                                                                                                                                                                                                                          SHA-512:9074AC8882BCECAFE4726EBE9625B57EC4410CC2F9A8293462287C76F0904B1B9D4AC181EDD99A3E525A36B307497B3242390FE19D41ED2420B3D70682E67244
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.....F...F...F.sDF...F.sRF...F.sUF...F..F...F...FW..F.s[F...F.sCF...F.YEF...F.s@F...FRich...F................PE..L......[...........!................].....................................................@.............................R... ........p..h............R...7......d.......................................@............................................text...W........................... ..`.rdata..Ra.......b..................@..@.data....E... ......................@....rsrc...h....p......................@..@.reloc.../.......0... ..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\360OKCleanNew.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7703
                                                                                                                                                                                                                          Entropy (8bit):7.976657033505565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:HMIbqr/uo/DmxmRl+hOzjR5tmIQUy92y7IoSx0nQ7:HMIbqB/D0k+4jRiIY9BC6O
                                                                                                                                                                                                                          MD5:AE5642CECFF7F604DE74E94A4B95670C
                                                                                                                                                                                                                          SHA1:8764ADD968072855334DACBDC92F1F3051521401
                                                                                                                                                                                                                          SHA-256:D4D0EF1AD34B647F8349E5D8EE532074819B1FB4A5EBC51782EAF34949707FAC
                                                                                                                                                                                                                          SHA-512:CD34AF537EC1E60B2EC0BD6F6A7BA01946B7684E01E70422FB71EA7C3014D146AD86F1A4252A45DEB5476C5BFD55F90CD97A0BB864AFF6DA81167ADF50C3B61C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:GSD....:IBUSOqBFl..<!...?lJF..Mq[FPS~Gz...!.+(.6:_2+-..|JA..B-.1N...E...6.Q...v.1.Y}.AZ.*rqqM3k9i....(^BV".h|.7...N.R{...x.=0T.>?..E.myD7.&.....Z...]. ...z.3..........^../...2..E..........s.1......s....n...5.#..,>..r..5.5V2........n.......hY.5.9..T...xrZ\._.<....\r....1.T..z..q).......G..k.....q...:8.L;.#%...<#.a......A@.%g.q.@Z..E........8.9%...G..8....3.......S8..(:....;}w&..i'.Dr..w...P. ..r.M q..@|..K.....\|m.jr...cY.E..................z.|E.....P....C............ .. .,=..k.....Y..!.....Z.G......(........<..+n.C.+.B.".'..#S\.].....c.u$g...+....0.^...p.Z.....<.'...O<.:[...D..PtU.x5G...QLh.&..........2...~....s.................k.e.....<.9...........u..=.%g.....(.D..g...0^y...(_..S=.2qF.G.5@.h..K.=....J.....-...2.W.{........t@........\S:Dj.Th....R..$D.l]:k;..\o.|g.8.B._yev.7.;..IFn...f.U.....~.Nv{.H......R.,`..~...l..R.Wl.C....fm.<o._M.m..u. .#.T......t|...r%J.e....Y'.zI.rN..3:..2QH._...i.../.Z.Z^.t...?.S...;uR......@...eoB.bb.E..e.......Q

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\CleanHelper64.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):285144
                                                                                                                                                                                                                          Entropy (8bit):6.264922116511452
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:xMvSunFlW+Gmpw+AnPTkJM3KDagdkNxIwyMsYh:xiSYFwBgwV7kbW2kNrTh
                                                                                                                                                                                                                          MD5:6AD1950D2748954C502FA2DD09366813
                                                                                                                                                                                                                          SHA1:E89954321C3688FEC2C44AEEF34F56E2A2B697D1
                                                                                                                                                                                                                          SHA-256:E9385A17FD137914639B791215A0AF1A83927D4E93EA8A2549B023797DF8B8A4
                                                                                                                                                                                                                          SHA-512:7538C474177780A358409B25A9E5955DA5D85E3B9DC3561FC8B9ADC6F42D16E2D01AA0D2E2FBA0258A35E1C66E5861A97BFF5AAC38992B771492F9220E80E2C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.V+.V+.V.. V*.V".5V..V".#V .V".2Vk.V...V/.V...V<.V+.V..V".<V=.V5."V*.V".'V*.VRich+.V................PE..d...g..X.........."..........f................@..........................................@..................................................y.......0.. B......x*...*..@/.............................................................. ............................text...f........................... ..`.rdata..,...........................@..@.data...pj..........................@....pdata..x*.......,..................@..@.rsrc... B...0...D..................@..@.reloc............... ..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\RemoteTrashInterface.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):479344
                                                                                                                                                                                                                          Entropy (8bit):6.443204751960536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:WR+TsNqaaYLpG1AxiaNkasViN2hzZ4YZkijmk59rY13HlXE7e2tD:aMs0aaYLpG8iaNkasVi5SjmQrYFU7TtD
                                                                                                                                                                                                                          MD5:3A604F30D608CB71A441E7FD2223ECEA
                                                                                                                                                                                                                          SHA1:353DCA9654C22FE92A21B86BEA659574FF80E072
                                                                                                                                                                                                                          SHA-256:4E943DC27C3DB6B2C1AEC21B17CB8A90AA60E9598065DC6CD4A396053EF9E892
                                                                                                                                                                                                                          SHA-512:CB50D3B63800141F218FC2ABDA4510FDD37730388BEEFE1FE0C8F6D13A8EE677C8DE064FB8DFEBEF3B94810CF59B9E50B1610E7F8F70C8EA3F3A2A669EE16576
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7..@V..@V..@V....b.BV..I.a.WV..I.w..V..I.p..V..g...AV..g...YV..@V...V..I.~.oV..I.f.AV..^.`.AV..I.e.AV..Rich@V..........PE..L....5uT...........!.....2...................P............................................@.........................@z......tj.......................:....... ...T..pS...................... ..........@............P...............................text....0.......2.................. ..`.rdata...*...P...,...6..............@..@.data....w.......J...b..............@....tls................................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\SysSweeper.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1030208
                                                                                                                                                                                                                          Entropy (8bit):6.702591967117128
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:xAatjEV8BANFtwnfXkw8GCj7vSEIYR2aZ+gEu5lsRuM7Tu0xMFGV7Ntwth8Q:hi8Bu7wfmGC85aZ+Pu5M7q0WMPw7
                                                                                                                                                                                                                          MD5:54584D1CC0308F82B31BB7643DE61934
                                                                                                                                                                                                                          SHA1:B260886B47771EC1C9EBE06F348819002112EFFE
                                                                                                                                                                                                                          SHA-256:98A854EE586D985C6C6B48C37C302B965750C3E7F8568440DE1580A892CB8B6E
                                                                                                                                                                                                                          SHA-512:C377E5E5411D8E8A19A318E0568C6F86119A37505A3C576A542EC28667357692C94C2C1239E9291EAE51E768D2A8B721BED9F29A50E2C2901551AAB26B119B83
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c..['...'...'.....t.#.....w.c.......#.....h.........>...'.........a.......f.......p.&...9.v.&.....s.&...Rich'...........................PE..L...]w.[...........!.....(...R......D........@............................................@..........................I..\....1...........7...............7...P......`E..............................@c..@............@..\............................text....&.......(.................. ..`.rdata..L....@.......,..............@..@.data...(....P...^...8..............@....rsrc....7.......8..................@..@.reloc......P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\TEngine.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):836208
                                                                                                                                                                                                                          Entropy (8bit):6.513285532762203
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:9B0uiDyvLWetgmUJL+Ln3pJsjNRn4LXKTvwMTDv6PoTsStvJV3nVkiHfA:jiDyvLWSeCZJw746TvwMTDvpTdtqiHfA
                                                                                                                                                                                                                          MD5:D261BB4ADDC4ABA4B9FD64C2C3646160
                                                                                                                                                                                                                          SHA1:C384637A8FB0B8A8021F662B79DB3F58FE3D8453
                                                                                                                                                                                                                          SHA-256:4978844EDECF89AAAAB39D9BCB399B850FE17D68F99D00632271B8C1F9CB967D
                                                                                                                                                                                                                          SHA-512:38AE73E39F59251F15A9F17A58EB45079D996F93C72244C44E9AE2FD5098F1E77EB44AFA15BB1561B7D9AEBF477ECD4196748C54AF5C583A91D7DE311D56FADB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v`...3...3...3/..3...3..3...3..3...3..3]..3..3..3.vu3...3.vc3...3...3...3..3..3..3...3..3...3..3...3Rich...3........................PE..L....(.V...........!......................................................................@.............................T............@.......................P..l......................................@............................................text..._........................... ..`.rdata..T#.......$..................@..@.data....a..........................@....rsrc........@......................@..@.reloc......P......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\Tracehelper.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):133448
                                                                                                                                                                                                                          Entropy (8bit):6.335819330890661
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:6yNcIm7T7tN5C1aLBnw6VQYhe/5phz3nYRI:6yNcRfpsaL5Je3NY
                                                                                                                                                                                                                          MD5:287E450E1838361EFA36788A4C6CC473
                                                                                                                                                                                                                          SHA1:18E18D2514A66C09B910C23FB14197B7FFF725C5
                                                                                                                                                                                                                          SHA-256:49D9D0FCDC7D9FED4A6ABBF39171B985D8C28B8843D1CB61EFBA822D0AAC9CFA
                                                                                                                                                                                                                          SHA-512:923CA94C59BAB300DE121B23D5060D41F01AC4F9F2CA3E01E1B8EA3A6E207566E03272F9BB0D99978ED80A57B941019C350B42BAE5450B401AD77346B00F2E75
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........l...?...?...?..l?...?..z?...?...?...?...?...?...?6..?..}?...?..m?...?..h?...?Rich...?........................PE..L....[VS.................4..................P....@..........................@......<.....@.................................<............B................... ......................................0x..@............P...............................text....2.......4.................. ..`.rdata...@...P...B...8..............@..@.data................z..............@....rsrc....B.......D..................@..@.reloc..L.... ......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\TrashClean.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):570944
                                                                                                                                                                                                                          Entropy (8bit):6.575301740843424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:FILvpABeDQdFBg0MUqBkWhCTrJ89Y5nFdE6b:SLrKxqBcrJ89Y5FS6b
                                                                                                                                                                                                                          MD5:05E63D2E277CFB06975AD31FDF4C8E7A
                                                                                                                                                                                                                          SHA1:4F25BE0BAE3BD041F6A4A68DDEB5A005E65579A0
                                                                                                                                                                                                                          SHA-256:2B1565289DA42E92ADCE52EF80124C6EE78C9BE5306D6848E19394910E4FA29B
                                                                                                                                                                                                                          SHA-512:A6987D93D59B087619DB8B10638F4A5BF83CB767BE075ADFA1287CA30F7711D42271AA3862B967EAE979EC0713927CA2CDECC4716A8D538B79A2D14C1E621576
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.U.!...!...!..*nf..!...Ye..!...Ys.;!...st..!...Yt..!......!......!...!..s!...Yz..!...Yb..!...sd..!...Ya..!..Rich.!..................PE..L....a.[...........!................................................................` ....@..........................................@...............~...7...P..Hi.................................. ..@............................................text............................... ..`.rdata..G#.......$..................@..@.data...@T.......*..................@....rsrc........@......................@..@.reloc.. ....P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\WhiteList.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (2286), with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2288
                                                                                                                                                                                                                          Entropy (8bit):3.9603446476191695
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:Q6FGqzHFGqZIpA0ys1zJFNjqW7Lkr+jc0bgBrt64ogTy3E+82+Le8dNuVQV:Q6Y4Yeqf13Nh7LYAwAhgEE+84MNue
                                                                                                                                                                                                                          MD5:15E717CABCC91F6074CF6CF996D840B5
                                                                                                                                                                                                                          SHA1:84C74B86BB34A11A46A66C22BABF9CB20239566B
                                                                                                                                                                                                                          SHA-256:2D2A0220668A3AB5FF45B02E020077FEA068A4316F0FCF4618AD182D5203ADD1
                                                                                                                                                                                                                          SHA-512:1F6BE0116C953FBC57332B52F31A09A505943C5E51EEEC0909F940772DF37A0BDE2B1011701D8CC60E90961821A9758DB492742781D81417BD5CE0977AB92832
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:9872ED14A25F0421F63E8267A25B044D8338EB64BE2F032482249F65AB5D0726F1389D62A3284F4ABF038509C4045C04DD7EDC09E0144114D7649C67CF094009C46CDD26CF3F5D03D96CD63BE7434119C104A57FCF3A5B0ED666D826CF1E4B13C66CC266A1315612DB7FCA27E031600FD162FA26F1434119C104A57FCF3A5B0ED666D826CF1E4B13C66CC266A1315612DB7FCA27E031600FD162D931F743560CDE04A57FCF205B03C066DC3AF5196E37DB67CB3AE41E6E23C77BDD30FD196405C07AC63AFD317310C229FF34E705413CC56CCB38BD084A059804A57FE85F7126F33E9E66A2400656F74C8266A02B774DF14DEC67BE5876268B4C9D60D15C0024F774855899470353833EEE13D05F7725843DEA13A05E7623804AEB60AA2B0025F03C9D64D629186DB823F300FD045C13C668C339CF3E530EF57CC006FB0C7329E023A25FB91670568B4F9C61D7291F26824F9678A75F76239F30EA11D7400B5585389762D72C04588A4DD27F9E671828F94CF60AD0217333E14CFC0AC1227D34EE5CC13EFD02450EEE7AC730FF016E0FC26CC131FF0A186DB823E71ED6346D23FE48FC06D63E6D32FD46FB09D7044005D17DC027EA314108D765C309F000564ABF03851DD8286B3FF145EE06C028613FE046E001CF294009C46CF326FB085E0CEE6AC231B960384AFA42EA0CCC2E7E21E15AEA06

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\360_install_20240725032741_5379609\temp_files\sweeper\tracesweeper.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):160354
                                                                                                                                                                                                                          Entropy (8bit):7.998949194579383
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:3072:QA93JvMbeVUJLIGccbyvugfUnfxWodmZGrMb0:Q8JvMyUTSugfqpxmZgx
                                                                                                                                                                                                                          MD5:0368564D1BF5F50FEAE0F98EDA02822C
                                                                                                                                                                                                                          SHA1:78E9C127C1873897C45958CCD918B4F51B82B62D
                                                                                                                                                                                                                          SHA-256:B586A06DB863CDD48EA60FA5296346D50689519824547753DDCCACAACA86208A
                                                                                                                                                                                                                          SHA-512:1ADCD98A97BE2BDFD5C288A1E8A436653B0F04353831A20BFD003A443D5E2D13E8870150F398B4BEDCBCD3FBA98319FF3C249857C261CE4347E48CC0990A7EA0
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:x8.C.p......i....r..\....(9e.4.|........r...,.c....%.H...m....Y...Y.").r.e..-....s..#.Xy-.3r....#f}K..9u....c^....2r...8f.|...Y\...*F8..m...]..5.Z..$HYo..F..A...k....=u..m...%.t....OT:...yO...U`\...bN..+Vm.n...gF..'{.OB...k...=S..^..3H.. q....Ul@..W0.[.w.....`_....l...4.V.j.?o..4Nx...?.p0..{...-.*.U[...}F.....ig..E....v.a....#.>.L..-b....?..'C}....,.+..W.0..Kr....}...EH...b...Es~..Mq...+. .SU..Jc...^..ga..C....p.k....%.8.V..#|p....mC..+. ..Z.;.%.Z.g....:~8.!lA... `O..[..@$..:...>xb.....!r...g....V.......9.^.k....:....|J..1.F.....2Jz0..yX..K`..._......*b....:qK...pl..W..lC..m#..OV....S...T..<.C..+APQ...mB..Q-.d......!.F..T<.2...../p.n..A..0t@.../.Q.....D;.X..pC...>x.......wW...:...%.8.V..#|p...;..;Gk*..x...l.... L`!..u...:.^.-~K...m..../..y...|L...;.O......$.......\...Z.n..\.f..Y*.@.....G(.S.^>.J.Tj..(.V.e..z..Y...H.....c..T..T.6zK.U$..Z....k...J... .0(.I..[...w<..|C..;..%.F.e..`..9...1......s.....y....&.s..{..^m....s....U._j..#.|.8.L.k..Y.=...3..

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\C__Users_user~1_AppData_Local_Temp_!@t65A5.tmp.mem

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17
                                                                                                                                                                                                                          Entropy (8bit):2.409267252251469
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:jleP6:q6
                                                                                                                                                                                                                          MD5:512DEE7E7F43DAE845D12AEFAA7D35ED
                                                                                                                                                                                                                          SHA1:2A0C673EFFD327F73A47653F0CF6C79E5638519C
                                                                                                                                                                                                                          SHA-256:0590E3D04B5D75EA34583DCBB5903A1B2F41080EB93A98952FD9DDE4B8361BA7
                                                                                                                                                                                                                          SHA-512:2AEA6F228CC2450DEC9F5DD04C19F603341D2E709A3FE081F1F6FF15374FA82398D8B3BEC2B0B669289D23E3478D70A48DBC460BDCD7D2F74E5DF5B4522B167B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.............*[.i

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\C__Users_user~1_AppData_Local_Temp_!@tFC09.tmp.mem

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17
                                                                                                                                                                                                                          Entropy (8bit):2.409267252251469
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:jleP6:q6
                                                                                                                                                                                                                          MD5:512DEE7E7F43DAE845D12AEFAA7D35ED
                                                                                                                                                                                                                          SHA1:2A0C673EFFD327F73A47653F0CF6C79E5638519C
                                                                                                                                                                                                                          SHA-256:0590E3D04B5D75EA34583DCBB5903A1B2F41080EB93A98952FD9DDE4B8361BA7
                                                                                                                                                                                                                          SHA-512:2AEA6F228CC2450DEC9F5DD04C19F603341D2E709A3FE081F1F6FF15374FA82398D8B3BEC2B0B669289D23E3478D70A48DBC460BDCD7D2F74E5DF5B4522B167B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:.............*[.i

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\C__Users_user_Pictures_360TS_Setup.exe.mem

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):116
                                                                                                                                                                                                                          Entropy (8bit):1.0664630607119836
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:jtjmSRakl:jta0aU
                                                                                                                                                                                                                          MD5:1D9FC0E857CD67EA72EFF4585E6B50CD
                                                                                                                                                                                                                          SHA1:D009D603CD0AF14F64F0B0B84681D7DEB7880049
                                                                                                                                                                                                                          SHA-256:561580DCC11671B20D9065BCEC081D40C33763A1B5EDEAB1FA36C98FF24E7DDD
                                                                                                                                                                                                                          SHA-512:51980062E04245EA078884845C2B857769C87025C3F2E06220828446B4EBDDC5F1FC4485A661FFEA75CCF6E6CAF3CCC276E39436AC105D887A7BB68598EF7078
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:..7.............................................................................................................<.H3

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\C__Users_user_Pictures_360TS_Setup.exe.trt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16160
                                                                                                                                                                                                                          Entropy (8bit):7.9889246558536176
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:bnHSnlvAkBD7fweAsv0/tUqTQ0dlivAYYfFbVz0mr+78nfOtbtIYSKX+Rkstz1yE:bnynNAk5MgefBVVnuBnStRJzyNl8x3j
                                                                                                                                                                                                                          MD5:72F5062120AF02209FC52F135D6FA614
                                                                                                                                                                                                                          SHA1:E8120AA291D35FF111F2D65C4F94130E4A28DB5C
                                                                                                                                                                                                                          SHA-256:5CCA2F8B7C803B67BAE42448F61F90B246FEA6515A802C837B81CEB47B8166B2
                                                                                                                                                                                                                          SHA-512:4367A685818E2D952AFCC80E7478B29A00F93F2713C3B4853923F2D5658A1311330A79E449EC7B4BDA36F23D7374E8BD48159CB859BA4D0F32C05500D2F39838
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:d8:encoding3:GBK13:creation date25:Thu Jul 18 14:42:39 2024.4:infod4:name105:_home_q_system_rtorrent_chroot_var_downloaded_7657608_int.down.360safe.com__totalsecurity_360TS_Setup.exe6:lengthi104329184e12:piece lengthi131072e6:pieces15920:.....l t...E...........h.l.....o`.b.([...%/..l.."..}LZ..z.~R..=.t..T..........!.~.2Q..@...6.]..f.;..h.....].....B5....]...~.P..4[Q......D..>H...j......Sd........!`.?..._.Yz..........p....<o.P.C.&...%..o1P_+.>g6.O.=.+...T>t.....0.....RY.@.kb..9.w..;..h.sIH.#*cc.............].6j.../..@..z..{a.O[.....{../...".O_.y...U.....c.g.^X.....[cN=...o../....,ek....N...:..$.K.38.....:.H..N...~.|..J.C.....&#.]...g..C.mrt...[..h.....v..7.#...R...........Xx"......w..V.6...L..KIz...@o.~Pm.._.c.O.2G.Hq...i...e....^..;../.WL..W.$.T..r. ...!K....M.v....[...U.^1=.Q...gfn..b.r2}.../.t|...{..L..n.g:f...-....d.j.."..Y..ix(...A.!......p.?.;...1..E...}Hn.3.d...H..)"9(;2..8..xd.....!.E@4.?#...k-.`x.q$V*l.A8.\@.......I.|........`......D.@.

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\{3EACC82E-6FA2-414b-A2EB-330078A5B296}.tmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe
                                                                                                                                                                                                                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):423228
                                                                                                                                                                                                                          Entropy (8bit):7.997681149467644
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:6144:84Cs29g7Owuqh51csTqqIe6WpdwNCGt6zoNsJLCwFwLNFtgsP83FrTMim:ZCsFlj1SWpdwN55u7FQZg9tTMX
                                                                                                                                                                                                                          MD5:7D883E7A121DD2A690E3A04BB196DA6F
                                                                                                                                                                                                                          SHA1:73E8296646847932C495349C8FF8DB6EF6A26CF9
                                                                                                                                                                                                                          SHA-256:9A54E77EDD072495D1A9C0BBA781F14C63F344EAAFA4F466D3DE770979691410
                                                                                                                                                                                                                          SHA-512:E184D6D5010C0A17E477B81CFBD8F3984F9946300816352D9B238E4500CB9C6DD0CDF9FE3BC2A1DB10B0CEF943D8FF29A1CF381B24B9D3F9F547D41B2FF9737A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MSCF....<u......,...................H.......p..........F:. .360P2SP.dll.:...6L..CK.{|T.8~f.$...s...2.(..&jt.58A.$.XB.G2.....t...L.m@.$.a. .E.........{..Z.w&.y....D.Z.'L....................s.c..^{...^{g..6s...x.$....c....?....M.{....7m..,.X.me..?.y....?...O.m....&...m.....>..w...n.`l<d.t...hS.....i?....+7..o..M...j/.m........M;iy..i..o..~q.4.`.[.W..N.......=4=N.}.}?....>z.9.D....7S.i'8.M..1.w.>?I.i.?._...t|...R.:._....Glc!;_G+....e?..&.[..e...91m.......Lx....=.q-.t.............w..]...+g.0......8.;j.y8....i}.N...Q.x)..V.{(.(!.....}.U....#zi...~.L..yt..P..jF.n...\Sn.......O.5.\.o..;..../'+..9...&.S...qM-.%.....@r.S......|...v....2....8.jN.}R$.L.l..i"..*5{.#.W,_JJ.s...4.f....R.{.-..Z....^S...=J...u.........._...a..~.@DL.Hm..`.uB..........f|~g......Qhj.wa.i.?m.9.j...G......U....a. c.^[J..F@.D.R6c..(..")R.....BK...YP...Eh...W96#..QR..s.x.......H..E...xy.Q.g...<.<."...l.<;I..`..g3.0...k..g3..M0A{p"n.F.......sf`..(...m....Kq#.p..w..D.Y.r|

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\{72EED8BA-9242-4de1-9063-4C81F09A6B03}.tmp\360P2SP.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):844400
                                                                                                                                                                                                                          Entropy (8bit):6.524408835675551
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:HZcohgVGBmUpL8XOgh6LaISFP5FF6snXcscXt5KmR+M6Pt2H6qXco9TGUc:BYJUpL8sFXGmU7t2aq59Ts
                                                                                                                                                                                                                          MD5:FC1796ADD9491EE757E74E65CEDD6AE7
                                                                                                                                                                                                                          SHA1:603E87AB8CB45F62ECC7A9EF52D5DEDD261EA812
                                                                                                                                                                                                                          SHA-256:BF1B96F5B56BE51E24D6314BC7EC25F1BDBA2435F4DFC5BE87DE164FE5DE9E60
                                                                                                                                                                                                                          SHA-512:8FA2E4FF5CBC05034051261C778FEC1F998CEB2D5E8DEA16B26B91056A989FDC58F33767687B393F32A5AFF7C2B8D6DF300B386F608ABD0AD193068AA9251E0D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............z..z..z..t...z.&.p..z......z.s...z.....z.....z..t...z..{..z.....q.z.......z.....z.....z....z.....z.Rich.z.........................PE..L.....U...........!................,................................................ ....@.........................P.......T...,.... .......................0..<a...................................................................................text............................... ..`.rdata..7...........................@..@.data...`........L..................@....rsrc........ .......D..............@..@.reloc...}...0...~...L..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\{80A65F34-A4CB-470f-9870-A144EF43C802}.tmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):423228
                                                                                                                                                                                                                          Entropy (8bit):7.997681149467644
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:6144:84Cs29g7Owuqh51csTqqIe6WpdwNCGt6zoNsJLCwFwLNFtgsP83FrTMim:ZCsFlj1SWpdwN55u7FQZg9tTMX
                                                                                                                                                                                                                          MD5:7D883E7A121DD2A690E3A04BB196DA6F
                                                                                                                                                                                                                          SHA1:73E8296646847932C495349C8FF8DB6EF6A26CF9
                                                                                                                                                                                                                          SHA-256:9A54E77EDD072495D1A9C0BBA781F14C63F344EAAFA4F466D3DE770979691410
                                                                                                                                                                                                                          SHA-512:E184D6D5010C0A17E477B81CFBD8F3984F9946300816352D9B238E4500CB9C6DD0CDF9FE3BC2A1DB10B0CEF943D8FF29A1CF381B24B9D3F9F547D41B2FF9737A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MSCF....<u......,...................H.......p..........F:. .360P2SP.dll.:...6L..CK.{|T.8~f.$...s...2.(..&jt.58A.$.XB.G2.....t...L.m@.$.a. .E.........{..Z.w&.y....D.Z.'L....................s.c..^{...^{g..6s...x.$....c....?....M.{....7m..,.X.me..?.y....?...O.m....&...m.....>..w...n.`l<d.t...hS.....i?....+7..o..M...j/.m........M;iy..i..o..~q.4.`.[.W..N.......=4=N.}.}?....>z.9.D....7S.i'8.M..1.w.>?I.i.?._...t|...R.:._....Glc!;_G+....e?..&.[..e...91m.......Lx....=.q-.t.............w..]...+g.0......8.;j.y8....i}.N...Q.x)..V.{(.(!.....}.U....#zi...~.L..yt..P..jF.n...\Sn.......O.5.\.o..;..../'+..9...&.S...qM-.%.....@r.S......|...v....2....8.jN.}R$.L.l..i"..*5{.#.W,_JJ.s...4.f....R.{.-..Z....^S...=J...u.........._...a..~.@DL.Hm..`.uB..........f|~g......Qhj.wa.i.?m.9.j...G......U....a. c.^[J..F@.D.R6c..(..")R.....BK...YP...Eh...W96#..QR..s.x.......H..E...xy.Q.g...<.<."...l.<;I..`..g3.0...k..g3..M0A{p"n.F.......sf`..(...m....Kq#.p..w..D.Y.r|

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\{BF2BE5E6-902C-4720-A988-382B5CE16F33}.tmp\360P2SP.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):844400
                                                                                                                                                                                                                          Entropy (8bit):6.524408835675551
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:HZcohgVGBmUpL8XOgh6LaISFP5FF6snXcscXt5KmR+M6Pt2H6qXco9TGUc:BYJUpL8sFXGmU7t2aq59Ts
                                                                                                                                                                                                                          MD5:FC1796ADD9491EE757E74E65CEDD6AE7
                                                                                                                                                                                                                          SHA1:603E87AB8CB45F62ECC7A9EF52D5DEDD261EA812
                                                                                                                                                                                                                          SHA-256:BF1B96F5B56BE51E24D6314BC7EC25F1BDBA2435F4DFC5BE87DE164FE5DE9E60
                                                                                                                                                                                                                          SHA-512:8FA2E4FF5CBC05034051261C778FEC1F998CEB2D5E8DEA16B26B91056A989FDC58F33767687B393F32A5AFF7C2B8D6DF300B386F608ABD0AD193068AA9251E0D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............z..z..z..t...z.&.p..z......z.s...z.....z.....z..t...z..{..z.....q.z.......z.....z.....z....z.....z.Rich.z.........................PE..L.....U...........!................,................................................ ....@.........................P.......T...,.... .......................0..<a...................................................................................text............................... ..`.rdata..7...........................@..@.data...`........L..................@....rsrc........ .......D..............@..@.reloc...}...0...~...L..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\U7C9WzWkhs72ELqs0HGle9E1.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\UIgbZOdyaVSQ6RYQSEeprj5d.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\UVfMqDwGoGEvVkVybkeC8QrI.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\UvEg1tNw8TQgEGoMoudW4MSA.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\UvKXEQwl3D7YytLyF1DjkOvH.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\V4FGFkKnEJS9DoImGBsPPCGl.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\VMlIObHT52VVzT4ZvJ2a0API.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\XlgZgJ2LJW81kHOYIHPmyxJ5.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\YiBUNoJoPIhAtYOnilMSPvZS.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\atTmWMexfjDNHZsj4eS3cFWa.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\evpB0G9LOHcHfChKbhcE1wKr.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\fw2TOiWzGo1NrFLSXdW9IHtr.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\hnKZFCj5oe7DMZMOnuhsEUAF.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\iaqDCrpk7XgTBT3Gv3tL3MhD.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\jeGjhHefWlrpFA9F19l2Ookm.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\m4PX6jHO1BAGyiLgBcjrjcWt.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\mtdHWyrYhqmLIpIP9DyhL8FF.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\n5eSui7h9Sj1Nl3mxAAYFshy.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\nPpyxVDuMw96yZmSf6gQ2TqY.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\oPt6fSpHRKiTT7Q1TPCGqKkO.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\pkUUm3iviYyjVuVwVzn44HrC.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\szkqjw57V0nOs0wQUlJUUsLd.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\t9bICacqM5w9awp82pyv2NWK.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\tAqt9uSHmrF7Z3H2xvM1lxwA.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\uE4ZDB1En0ie6pdAAAmn6VpC.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\uERxbc5vCWNlPNYfvjfoiyga.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\wZdNhoVbOYgB7TrwJAsCrFOW.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\wmjbSar71ZAYUF4cNnOUSNWf.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\y2xlfwgZYtLHYanrRQ8JSWVl.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\yE7noGQXNcOT5zohTTwqK6bF.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\eb42b1a5c308fc11edf1ddbdd25c8486_9e146be9-c76a-4720-bcdb-53011b87bd06

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):50
                                                                                                                                                                                                                          Entropy (8bit):1.5212424590621707
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:/lvlp:p
                                                                                                                                                                                                                          MD5:C851BF93667BDD6310D56581D955C2AE
                                                                                                                                                                                                                          SHA1:8FC5AEC1542BD7471BF815632863622EFE23A834
                                                                                                                                                                                                                          SHA-256:3C1A3E1EF8840689F0C6EC14E22435FC79EBC3F8771B7CD230F784CC81AE431D
                                                                                                                                                                                                                          SHA-512:D3D597D36DE0EE75AA44F4F8571E56DAD810E7E6C9839F5D5E6BB05846AB6E61FAF1E9530333BD6EC5AB04098AAE935A522DBD149D214A5971A7368E18C3C9B4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:........................................user.

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0Sw8mVAoATaNcrREXaxGRBLH.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.898881669050873
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5dCTsV8AKiVKkiF:fE1cNwi23Cs9K2KJF
                                                                                                                                                                                                                          MD5:6E4C4311007CE77D5F4E19A8E71B1E8E
                                                                                                                                                                                                                          SHA1:DBACBC2D7C59DD1A1D20D278CC6A5EA373DF739D
                                                                                                                                                                                                                          SHA-256:77F6AAC07BDC6C89DE2DFDE22D9A706CBE6CF9BF73BC3BD8D2C029B819E3AF78
                                                                                                                                                                                                                          SHA-512:999897A767E0710BE6E3238C0EDD0E750EF165E5A34BD4D80D8F9A09040048012DDF6424354D3F3C25E28F8BED3B3C10EBB9CB0FE537D222331E7BE51D7ABAB4
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\8gHZdIpZQLlZm3sIFx1QuBpo.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0hV0gAK22xvEtgvyKQ5yOs5n.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.0789676110621835
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5R//gVMzdRMN+Wn:fE1cNwi23Z/QMzdhW
                                                                                                                                                                                                                          MD5:A92C45D864E9464153C00309BBF6274B
                                                                                                                                                                                                                          SHA1:7B97976F07000C5933D7F58E8322BA2209BAB530
                                                                                                                                                                                                                          SHA-256:CF1478DFC40909DEA7AD706352F3388442723204FD79A94B696B14C30B397F7C
                                                                                                                                                                                                                          SHA-512:5B6E270D8599EAFE3D207D542987FF52D22B993D8E04F86C110614B3D1D9B087C18F79A158320DA831F401AE7B7973D485F80F3F15E5EAD161B189CA61B17AC5
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\4ZZwfXAuJ072C1VqOfz1A4ih.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2dZXHu4mBuz0k7K0hcQByrTC.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.936619854012017
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5At6zEAl:fE1cNwi23At6zr
                                                                                                                                                                                                                          MD5:B4C79E1063A235BA00E60046A24AC7DD
                                                                                                                                                                                                                          SHA1:1E9144FE5D6ADC25C4E572DF0431CFE1F92EE1A6
                                                                                                                                                                                                                          SHA-256:9497AD56F84EFA924A2F77B447042A65FCB28BB6D465549DA938F9B5F80E6985
                                                                                                                                                                                                                          SHA-512:D536A0470E0697302C1F7589D8B28D1565D4A40DFF2A1485566CCBB513D52335386E218A7A077D34F61F655FA3F91906B83079546F6AF18812DDA4AC0F687815
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\evpB0G9LOHcHfChKbhcE1wKr.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3zFuzRgWu8nsIZVxdNWJ2gln.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):5.046208895107908
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5z1qNmzZdX2l:fE1cNwi23pqqZ8l
                                                                                                                                                                                                                          MD5:29EDD2FC79800134987F4086E699CF3A
                                                                                                                                                                                                                          SHA1:628843CA68AA37A3A4D768D9B0EADF4A0855ED76
                                                                                                                                                                                                                          SHA-256:43E3AE529EFF000FBAF619BD82B97AB13215835DAF716F7FB983CD16B6C7B451
                                                                                                                                                                                                                          SHA-512:353A957EC6471E1795AF72B598B33A329DFF1EC6644D8E64DC4324BFE26815211B80BAE1F03BBD14D68AA035E932A6FF09ABCE63C55EDA2704B1DCA75B831472
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\VMlIObHT52VVzT4ZvJ2a0API.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5wRhfRBk6MCDZeJ0qEjmfyeG.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.025634277728849
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5WNUcc2K33q8kiwWn:fE1cNwi23WNUYm3qp9W
                                                                                                                                                                                                                          MD5:70AC7C6D3560C9800CC7D7FEE8B8DAD3
                                                                                                                                                                                                                          SHA1:F49ADBF43BB64F225FA2FB89F73A0DB046ED1AC5
                                                                                                                                                                                                                          SHA-256:97F57F01A1D66D16BECFF72915C03E9BDC116F47E549A373E93923C988D0DB3F
                                                                                                                                                                                                                          SHA-512:EDD569D42A7A30D99E869880062AFD0BEC7D2E5F703BAFD6007BD8E8DA767B335D5700516F26E8E9B06C101B3598CBE15CDF848B41FBC2F4298BF640579B90C6
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\36dsvh9ycgNnqmR2ByFaAF5L.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7GHKGgWXYpBu6ujvkCqrAqEk.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.853893150779031
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5WfO68VHwJvspiEwWn:fE1cNwi23Wv8VHwJvsmW
                                                                                                                                                                                                                          MD5:20C8BD03A3879B9B7A80A7DFECAA33E6
                                                                                                                                                                                                                          SHA1:44B660BEF5B4775FD99E5A73A0CACE678B918B54
                                                                                                                                                                                                                          SHA-256:B0F6E91A3AFD44C9D4EC39C61F5ABF8B33132DEDA9574BCAB6A34912D2FB531F
                                                                                                                                                                                                                          SHA-512:A1B82787951284EC8E7451A27DF419FDFB0A3820B37ACD80A63F3924D8AC2F089AD0753B5E836764722E71C996AE9578D3857E0AE7B9B685F4DFD7BB19FD82EE
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\szkqjw57V0nOs0wQUlJUUsLd.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9zZvqHeESRzOOvzVhqrk9jbq.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.974358038973159
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5SI7CU/6jRGrew2Ts:fE1cNwi23SI7XyjRGaTs
                                                                                                                                                                                                                          MD5:545B11789325ED66ECEA2F5DED5C386C
                                                                                                                                                                                                                          SHA1:67AFC9ADA264C5033705AEE5ED4B444EE93DB17C
                                                                                                                                                                                                                          SHA-256:7DBF96E6EA8FAD7FAB569D503A517D00AA8D78D3C89102B2304FC8A2AB443602
                                                                                                                                                                                                                          SHA-512:D0CCDF550E00AFEDDF57E1B6A669C8BB5EE938B1EF281AA4E8E1C73DA7B1B382D218C5D2C4174CD078DE9B13C2D16145BCDFA28727AE7F3E1BBBAE3C0F77B9CC
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\wmjbSar71ZAYUF4cNnOUSNWf.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AYU4aYQGSewAU8NRdpVSLYs1.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.955699444424362
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5m7tkOlKWn:fE1cNwi23m7tknW
                                                                                                                                                                                                                          MD5:82451F8F36BB78B67055D9911E2F741F
                                                                                                                                                                                                                          SHA1:F05BDF334885DDA7720684B49F8AD6B4D0A68169
                                                                                                                                                                                                                          SHA-256:1D3591807EB65EE856C7F833EF5D5CAFFAAC0E9A4CFE7C9B2AE3207B8E45B866
                                                                                                                                                                                                                          SHA-512:05C2236395A8FA92331C2189568B10993DC41CC463B01CFBD1DBF53218D880BC23B3D30EFCEFD779D43076CD731330A5CB60EF5C4E8259FC16C915BBBB08ACEA
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\C5Kjr9aaz6hDS52NkOqq8y55.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BEyHr3bfAnMOq3irAN86EVFJ.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.8520402776134635
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5EXQOPom2BOiACHwWn:fE1cNwi23EXQTDOjEwW
                                                                                                                                                                                                                          MD5:EC3263CFB61069F4E2ADD3F5C55F401A
                                                                                                                                                                                                                          SHA1:738C75411111274C8A8A1F8F015CB9EDBD8F2B97
                                                                                                                                                                                                                          SHA-256:74B1FC03F41E362A1FC23167D57CA7747A0CFB3F6B5CF768FA333FF8502657C0
                                                                                                                                                                                                                          SHA-512:7114AB33CE0D1518EDF157A170D52EC113F7F41D4700CD554935E011642D4D5BCF6E3918D5C67DEAEFD8733297BA3F5FCC29A1FFA9B4CF07976B6F0F1EA93716
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\atTmWMexfjDNHZsj4eS3cFWa.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ByP6u97qxNfZ81fsarYDva02.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.965385134424482
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5h/Q9fLiTwi4m:fE1cNwi23pQ9f4
                                                                                                                                                                                                                          MD5:787AC5CF9F0C18B4D93A0BA1E13BF260
                                                                                                                                                                                                                          SHA1:2BA095D30DF110EC3B0AE0C19E415D6A269951A0
                                                                                                                                                                                                                          SHA-256:EDBBA64654B8DC76C0C3B487C616A525378DAD11FD8F88EA00464C8EF0DBA310
                                                                                                                                                                                                                          SHA-512:6D4D1EC7AD440D121DCD330DD5825A7E90B16A47FC63E265A18934B23B791A23C576CB193B9204EA92A8702610AF00F6D4E418B3E4B95FA2BAF9557FB84F87C3
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\DZN9HaS2r82y90oqcDIGvbua.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CCM79EJDWoOaU28j3sM2Lwwo.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.979705429734299
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5W9QFxSozrJXS0diF:fE1cNwi23W96goo0diF
                                                                                                                                                                                                                          MD5:E69A991DEDCB2D66C863EE2BCE788261
                                                                                                                                                                                                                          SHA1:1F652040C4376B557C5ED58B609C74D722A7CA37
                                                                                                                                                                                                                          SHA-256:ABE4A32762022E2826DB968549A319B18F78C1DDE5CC965B3A519C3EB0F66C5C
                                                                                                                                                                                                                          SHA-512:B90CA0E3B19671C2626277BD81A19C1BAA85F6AF558512E2F2D7F48DFFBD950D8A9A86801C32B6D2131FFE7B5C8E5237555237B86E8CB563F09A9E6C16B68359
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\3DN5iaTYoSMvSYVEgNVq6srw.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ca6YBXJj4xO3yMydtaSpZbg2.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.03217061100449
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5rRw1VEP5HKMZkzL4mKWn:fE1cNwi23Fw1mhn+SW
                                                                                                                                                                                                                          MD5:B1437F10394C285A45D6025956A9D885
                                                                                                                                                                                                                          SHA1:478D3EE126FBEFDAB8589B255B9E3AF506435FF8
                                                                                                                                                                                                                          SHA-256:9431233033D4ED40407922B5FAA2A4D6BB4F2FFD15AA70716F379276ED4FAEB0
                                                                                                                                                                                                                          SHA-512:1C528F96BDE74F12B5858D83070EBC4CC92B92DB0A4D991B9EB2C12F5249CE7357A69E4A72B6A75CAB3749E2D3739F5AD1A39576439BE3700C4DB2B2568AC14E
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\N4T8qP0zIsmhNbok9EeYkn9g.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CvIKtqidl2guUPBHjxVUFQtv.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.988902444366671
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5RkWjSLDsKWn:fE1cNwi23XjSzW
                                                                                                                                                                                                                          MD5:8A75EAA21DB8D0A7AB66671441F46775
                                                                                                                                                                                                                          SHA1:FC21A22471BC27B52312ED746977E8FAAA6B87E8
                                                                                                                                                                                                                          SHA-256:80EA8BB99ACF0D6FAFDCDB8653C81FE346B949CBBF0654A9709247374A02DAEB
                                                                                                                                                                                                                          SHA-512:9B44D0C8E7A0DBD55E9B3A03CCDCD6F251CB09955A295DA326F5B597697A813532D7510270FE9BF49D68733BB5D0F99AA5A3011B6AF7EA09FBE9C8BB1D180AFA
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\tAqt9uSHmrF7Z3H2xvM1lxwA.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FEvbcWeHlUCQ6wJiJ7Ty3YrK.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.024302738127385
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5VJhy6AfP49Wn:fE1cNwi23jhsSW
                                                                                                                                                                                                                          MD5:F21E03D33E56FFC7BBC3BC42BE1B313A
                                                                                                                                                                                                                          SHA1:611EA74E6C46B3C891A7B2129AF234E4AFBAE899
                                                                                                                                                                                                                          SHA-256:4F7BE7069CE1A45396BF5564AA0585BF85DD72FC1D74B5B57DF6287B396B1810
                                                                                                                                                                                                                          SHA-512:C0F4BC040D4DA0DEF2D4DE9DF19978BE574CC7716A723C977B3168BF6932DE90F550F735DA0292C30EDC211C502081D08B7DAF3472471719466FE20F229ED938
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\0lzVim7riCB1upr1FUP8xSQR.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FVQRuTSzJTtHAXSQWwQCLvZY.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.859442365106046
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5g9IeHaFkQWn:fE1cNwi23g9fwW
                                                                                                                                                                                                                          MD5:25CC8602D32382034239C6406498F6DA
                                                                                                                                                                                                                          SHA1:C67E0D746ABE6791438F57DBCBD957B2D018E9A3
                                                                                                                                                                                                                          SHA-256:7748CB3C84475C69F26E23E3D647D29E5773F163C382671EA3054B45525CA03B
                                                                                                                                                                                                                          SHA-512:F93D6E5A023E87A7B583E6B4A1B3F317505450F2826A36B7014D639270F07871085B3792604F6E5BEEA31C8E57CF7BB9CA2954F24774D4359362EBFCC5306FA4
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\Et3mnRfmuPQFakro2oc74eeS.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FdEAiaBtdTb53bxGipyuLeHz.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.909222593738043
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5In8hQ4hwCl:fE1cNwi23InAQjCl
                                                                                                                                                                                                                          MD5:70A61F77427D6C83112B809C20094A85
                                                                                                                                                                                                                          SHA1:E4B07B1E6E9E710AFC42D8C3EF3A3D0606D54DAE
                                                                                                                                                                                                                          SHA-256:D8FF5C66C554DA200D22B78A7B04D140CA04F300C33784F2E440B19FC2052680
                                                                                                                                                                                                                          SHA-512:37369BABBD629C5DE26323AA584043757F5D473AF2C30C9C7D8D018BD34AD14F015716B471D5EF847509FE51696BAB58CC680334454654BC9597BE05F36220A8
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\mtdHWyrYhqmLIpIP9DyhL8FF.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HVygIk5xltJ26qO7i4Ttg3dw.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):5.051202429033937
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5TZW/sAz0AACln:fE1cNwi23tWr0ls
                                                                                                                                                                                                                          MD5:A82419F5B761CA21CE2A932CABF1AEC9
                                                                                                                                                                                                                          SHA1:61563CCADEFCF80DBB5938724D46C15442A77207
                                                                                                                                                                                                                          SHA-256:0506B4760E6E74C007AA3282D76A8F7A8A26D4F9E78302F8A94D2C0DACC982EE
                                                                                                                                                                                                                          SHA-512:4816FCA42EFCD03EB3275A5FF5F5CE67AC06DFFC2C6090112404BF87677BC5E97DC6EAEF38A0C6DAE75E3E368DA665863FED70FBF9DC100DE699A1ABB02D3869
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\6l2OHZVq9ozMIVBLr01xSPSn.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IcfW3XsxniNtxPUg3uti8t4y.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.067570904765206
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J51xTo7LHgmpVeQKWn:fE1cNwi237To7cmaW
                                                                                                                                                                                                                          MD5:0ECDFC920E317566B3968B361DB95560
                                                                                                                                                                                                                          SHA1:7C6934680D908F62B0C6E6DE789EA09AD8DD5FBA
                                                                                                                                                                                                                          SHA-256:55A3F6D34C466C26F80FAD6656E4EBD29245573DE81B79789AD3D116181FB1E1
                                                                                                                                                                                                                          SHA-512:35FC1B494B79EFD432028A297DD6D98AECD9D3692AEE0273D15BE9027E6784358034A0AAA94B0069D607C4AD201BA234C24FCBBA69F573382742BC0A08A004FD
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\PT6Mx7KioNvzBAtCL7QX2GXq.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M1OuzBuysJJ6kE8KobZHawCS.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.93798787415051
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5mkHbgqhxrWAdAln:fE1cNwi23m4bgqnZm
                                                                                                                                                                                                                          MD5:F30C98D2EAB1A1135A2AA35EBB27767F
                                                                                                                                                                                                                          SHA1:5667F9B087A281AF578CE12CE0F8A7BD8FA43E4D
                                                                                                                                                                                                                          SHA-256:83CD5497C9315A2A488B092BBD42D2E499D9DF95A362C8FCD0562BA4561F8FF2
                                                                                                                                                                                                                          SHA-512:C0897889908853C30526DEB17EA74CD76190D693956A64FDAC5FC04B80A0B65795445BA9061E120833B02B6ECC586E7ACAAFB3F44997D421832B634D99F8E7C8
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\CXuRBddRChUEwLDDTAGzBHG0.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mc7dNCewwnFtbMeKarYV0nyt.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):5.001755299247133
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5wpvnmrAACln:fE1cNwi23wpvEAv
                                                                                                                                                                                                                          MD5:5C346CC518E17FDA375CAB578AEF451B
                                                                                                                                                                                                                          SHA1:CD984F71CD071C53666EE6CEFA77AAB5B3D41588
                                                                                                                                                                                                                          SHA-256:E5A73CEF1769E7F9D90563DACEB88C2DFAF7CC7FEEEB949E713BC6C1DFCBD2D9
                                                                                                                                                                                                                          SHA-512:3B329E095C53BC7B3D6FB1C8FCA16BDCEAA297A4F10D2151A25994415DCC38CEED437B3F327032A580D707D2B197CA5BAC3ECF88224F9CFFFED52FB94EA8AEB7
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\UvEg1tNw8TQgEGoMoudW4MSA.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PmY9HZ56zikoreGGsiW4JI8R.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):5.030520579659598
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5mjr4kHLmSP:fE1cNwi23mX4OLmSP
                                                                                                                                                                                                                          MD5:8FF72A3AF9E2DD3005BAC09761A3EDDA
                                                                                                                                                                                                                          SHA1:8DAADD56CEAB2493AF0A0C0D7E7A58369EC957EE
                                                                                                                                                                                                                          SHA-256:EDEFEB672CB339EA9FA97AF14A50F28527DF53F6B5AABF5773972E35E8A33FFD
                                                                                                                                                                                                                          SHA-512:E3B0273A823CAE64B4CD83F8448A4ACA99285C8CFA419BE1F424343F73B2EE595ED7FD41F0298F14DFFB28A9D988B824297E15E0BBDC7A0882E6FA5A1575E690
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\CHlvcwjKXoNvEPi7AbbOuC76.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QaR7JQApk4Gm5USjcAqonvDp.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.040904238098538
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5w/09zU4mKWn:fE1cNwi23w/+USW
                                                                                                                                                                                                                          MD5:060A51808B6CA8E4B13BCA25DB09937C
                                                                                                                                                                                                                          SHA1:D31D552063E33714E71A258F414B66A44E422FDF
                                                                                                                                                                                                                          SHA-256:4DB0F0F3A367FFAC07E253D94B3E1A06DC1BB170D1862BD1FB4A0E762975D948
                                                                                                                                                                                                                          SHA-512:BFF09C804F171914BBFD7C6E810DC341B4FD45706080A68D06E59E3579BC6F8746C277F20067D0A52E6EA7DE1D2307D1828629FDFCB27CE96EA205197107A550
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\UvKXEQwl3D7YytLyF1DjkOvH.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SlrtBJJYXextedHC5RRXtqjD.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.953676189598818
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5zRjrEO3I/1sSFn:fE1cNwi239jrEO3I/1s2
                                                                                                                                                                                                                          MD5:3409ED2F46F32E8E7708B6C9EDE8AC8C
                                                                                                                                                                                                                          SHA1:4F049BFBE989A4CBCC0EA6911ADB1D6A4762DCE5
                                                                                                                                                                                                                          SHA-256:60DB263D63B444C3CD96B4F7252B797A503DE5F4C8F5DDD7A4F47C1805106B8D
                                                                                                                                                                                                                          SHA-512:E7EC5C6D6D42542B284B01D669CBFADF08025DAECD906B430A862F9C3001832AD272783A803946B1740D805C534047A02A4DDAC2752B553D9F808E197259985C
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\V4FGFkKnEJS9DoImGBsPPCGl.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TmtCXHeFfNXnhKof0nPqXoXk.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.062366111091029
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5qSOa0NUHF+Wn:fE1cNwi23qSOa04F+W
                                                                                                                                                                                                                          MD5:9AF4348EE3638AB514A12CAD1862DC64
                                                                                                                                                                                                                          SHA1:8DBF4778713F77492BF974E8D69D826385B660F1
                                                                                                                                                                                                                          SHA-256:3DD0AC238469593E4587D277F899075B834554D07C8B6DBC6C8BB22EBF6944DD
                                                                                                                                                                                                                          SHA-512:AA21EAF2B5D052A1661CAB97C9DB1D0427CECAC1B790E2639BB19674FBFC23A1B0575AF16A29A4CD828891D70EDCAB60B8B3911B042DC1EFC8A939D93D7C5BFC
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\OwwOgzkPQh7uMioCPDE28dVh.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\X4AeTFkWxvvr0UutH23jyajK.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.991414374559962
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5ITJtEkgAHF:fE1cNwi23ITJ+W
                                                                                                                                                                                                                          MD5:F8F1E7DC739A604EC32F40E53AC070FA
                                                                                                                                                                                                                          SHA1:6C2A4605EF6F1559B4A1705780511F7F36AD5F91
                                                                                                                                                                                                                          SHA-256:D1BB7FD56F74EB237288B9EBA4F2D7D0EC5DA8BD4E8AE2EB6D73FAA57321A820
                                                                                                                                                                                                                          SHA-512:9D03BA0CEBEB475CFCD25FA52E7368378DA990BB212B9014C23859266DD42602F84F9D78F7D2D4C5EAF895B376585118B3B29E09C0E342C5840EA44393C2CF5E
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\m4PX6jHO1BAGyiLgBcjrjcWt.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xvy9mj0sqpawGMMbF7MUoN4G.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.089032777757695
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J59JjdfocddAlKWn:fE1cNwi23r5focoQW
                                                                                                                                                                                                                          MD5:D92386C17BC74A2BFD94E2398CEE261A
                                                                                                                                                                                                                          SHA1:2C84493EBD20CFAFC6FE5991B88F430E56C0C57F
                                                                                                                                                                                                                          SHA-256:F9932DEF2DA463225B21B82E3DDC5637CC522898E8F74A79BCF35A7B6FC34E06
                                                                                                                                                                                                                          SHA-512:49C71A11E9D1EFBE4FC77ABC1FDAD82C4CF86426423629B75592D73CB553E2EF27A72BE5860786A55BF9D2B9BC115AF8FADCAC8965008A1B42A15C9CA88E37CE
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\XlgZgJ2LJW81kHOYIHPmyxJ5.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YmyYC9ZIZqInZy9lU02lfnot.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.979705429734299
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5QHeUUeyLmn:fE1cNwi23QrUeyC
                                                                                                                                                                                                                          MD5:79DC04D5487FEA8E4FC41D62D4DCAF38
                                                                                                                                                                                                                          SHA1:0142A0B80D50574302C3EB84641771D7071DFE42
                                                                                                                                                                                                                          SHA-256:663D1A95AA1048785AD127D963154F9A93589BF1EDFA1DAA6CC6E41438433DCA
                                                                                                                                                                                                                          SHA-512:9B7DE13DC14935E82AFBF17FB768026B1CFE6FBE6D5DFBBB7BEE3B139EE7BEFF9E749F34CFD0AA4E1B203C8FEA0C30BB7345FDCC10254F591E9A3E9F2B9ED8E1
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\5xh1kzRK1sY56wRtA0VfLbHM.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZaKd5MYji3kAyTfvu5KO5wp5.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.981073449872792
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5QgRJBCELNl:fE1cNwi23QgRJ0ELv
                                                                                                                                                                                                                          MD5:31C0D6F18C8B78005407ABC6E72999E2
                                                                                                                                                                                                                          SHA1:820DC52E3D3E5602F7812369A7C49EAD08144EB5
                                                                                                                                                                                                                          SHA-256:7469323DC18110757EEED68AF4DE60D604A4A8954710DE45F87759B3CE70D2A5
                                                                                                                                                                                                                          SHA-512:6DA3D671DEE02B2680B04E74EF8C592F6DC9D30E0C9E65C2900285E219F6FC786B9CD7E2C58D899EBC9469EC5389F9BE5C0D0B1C544A3D6C90EB79B7CE9F84C3
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\uERxbc5vCWNlPNYfvjfoiyga.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZsZOFxiSwOteG3HE4X7AykQ3.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.996761765321102
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5LQcBvaYjEAl:fE1cNwi23dByYjEAl
                                                                                                                                                                                                                          MD5:0B81E3DE7BC43D6557EF366D68ABA4FA
                                                                                                                                                                                                                          SHA1:5AEED7BF434752914664A2C16E95045BC4F1C3E2
                                                                                                                                                                                                                          SHA-256:3958F9C70D4CE28373DEB9F11BC66E70A050829F5635A13A6E045C639BD61B95
                                                                                                                                                                                                                          SHA-512:A09B43ED85101A96424B8E325973801CBB4A9BAA87499CCD68DF46FAC024B6AB6EF303B9A767D691BC272D03ADA86ACCA2ABFC030F0D6604B4B51FD31F06C37C
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\n5eSui7h9Sj1Nl3mxAAYFshy.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7pCdXa3VPPixXDeiDERuIUe.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.976174198468226
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5cx0RBLmZFvKWn:fE1cNwi23cQLISW
                                                                                                                                                                                                                          MD5:1E0139759549F2CB3891DFC87754B9B9
                                                                                                                                                                                                                          SHA1:0F535FAD25A9DDD6DC69288DFE0485E00928419D
                                                                                                                                                                                                                          SHA-256:4C488F1CB665E06A4A7257E3FD36CBEA54C70155C62FEC88DA321F575C0CE8F5
                                                                                                                                                                                                                          SHA-512:BF259B5B4B8ED7AD90E72795D9C7EF118AC8A54B8EB862CCCFB93BB913BD3195EFB8C3A8C729C1094620981244A2D536E863894A50931363001E66B5E002C46A
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\y2xlfwgZYtLHYanrRQ8JSWVl.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aWJAM7LmGVjrqyGFkBX76m6y.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):5.1010034156558515
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J52625yRldt:fE1cNwi232Tildt
                                                                                                                                                                                                                          MD5:43DF7A42DF94A5310C34136EC5098FF5
                                                                                                                                                                                                                          SHA1:7FAFF5234F79D6BDEF2A69F334326400F27CDAC4
                                                                                                                                                                                                                          SHA-256:22F7E8B65F7668C0116500F6339B46CACF3168AD0F4D55F219725410C931D4FC
                                                                                                                                                                                                                          SHA-512:26535C74E991D9F5AA6DE9F622E3365950ABEAB5B834FC9EEE1B8757D1D99165D7AF436A113AF2FA08EEE37045E2637E2761CDDF6F32F961192ACB25A335CA1C
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\SXah3THn9M8VoE65mbOGcxLZ.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dFBhuG7x7cuyTo0UEY1FLx3F.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.902507182838413
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5c0d2PYJQeEpJCwVdm:fE1cNwi23cjPYJMDW
                                                                                                                                                                                                                          MD5:800CEFB1F3ACCCCEE41104572EBA9494
                                                                                                                                                                                                                          SHA1:4D55C00B80BFDB170984D28FC84EF09BA437A43F
                                                                                                                                                                                                                          SHA-256:CF8C612771E77B43E0DD249EE522601B6AA0D9E878D857A7FB698A977EA93933
                                                                                                                                                                                                                          SHA-512:DA4B33180DF2B4E3CF99FAA979A8E11BA2E265E52DA903DFD6FDF91EDD268A4D44D49F58738197B6D5C81CDDD3015F83A827FC611C61467F2881A28275256430
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\9fMPr9bjofOW56waLjTgg4fo.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ezskEwZPmKODwzVBTltwetRT.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.8544280731901
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5QgRpnUgLzbsn:fE1cNwi23QgfnhXs
                                                                                                                                                                                                                          MD5:F52E78C0A96857F0F753689C3195B66C
                                                                                                                                                                                                                          SHA1:C3D3D8199D5EBB29D0D0B2BF1CE66A158AB06A96
                                                                                                                                                                                                                          SHA-256:A2CAEDC6C751DCAD3732A4ED9E5CEBC3CB2D933637EF20140E7A2FD4631C320A
                                                                                                                                                                                                                          SHA-512:3D5A0B525A799235E98B1ABC93913021BAF6228D1BA4A8DAC059156FD5D58682A5430BA3D79A2010B32B8005058D575AD2876C60CF44BF5FDBBD28CE0D54FAC4
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\uE4ZDB1En0ie6pdAAAmn6VpC.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fYK2NbmAGi9Pg4SG2aLRfRmI.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.924172404736359
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5wzDoRigTzOwHOAPX+QWn:fE1cNwi23wvUDTidU+QW
                                                                                                                                                                                                                          MD5:07A345A3B4DBE1B9A627BDD7C546F5D5
                                                                                                                                                                                                                          SHA1:C6CB48B476036AA0280186627A492139729A6962
                                                                                                                                                                                                                          SHA-256:72CD1FC513B8F990E19CEC92525E26B636344956D6CA8CBA596AE65DD9488E13
                                                                                                                                                                                                                          SHA-512:2169F2D8509EA56A5A8A34A2AC1FF0E0748CBEF23977C6F2474C6017D559B1FCFD2FA5BCE28D714EAFF61821F07BFBF74A5772748318EA9FA2B349E0419F05E5
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\UVfMqDwGoGEvVkVybkeC8QrI.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ftfiPBwwMqNVVJZnn7PZ42oW.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.898837277671157
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5NLWdKOvkNWsJHwWn:fE1cNwi23ZFOceW
                                                                                                                                                                                                                          MD5:2EDE95A38869AC9EB2FAD999E6382F26
                                                                                                                                                                                                                          SHA1:A36035D720E9CB2D4015E2127D2C519C82F59CA1
                                                                                                                                                                                                                          SHA-256:E64F6F06D9D9C1074CB8BEDB92CAE108216F51D4B66A3E904596A9210D09EF8F
                                                                                                                                                                                                                          SHA-512:0D262CA814F991EEFB35C29066E79C9642FA9A360C684940A234127F3894FB2A346C0048D7E9467A9F97BC907473AC984F2BFAC8B48D1D4D302A8A7C9BCEB879
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\hnKZFCj5oe7DMZMOnuhsEUAF.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h9wamzhzzhwACA9Mtcf07wz6.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):5.046208895107908
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J53GVvf+YI5LNl:fE1cNwi23WVvf1mNl
                                                                                                                                                                                                                          MD5:824B23C56AD764897E14F1AD5EAD14DA
                                                                                                                                                                                                                          SHA1:CFF6D662356316756F0068559F1C8B8A50272651
                                                                                                                                                                                                                          SHA-256:E1D7B22B88D48314C996379B5C8FC92302982D226B93F52A26774B096CBC2900
                                                                                                                                                                                                                          SHA-512:22139D634D773E915F4FCCE1DE9E432FB6C618F82C8B2B7E5018C8F4B7699B55707734FE47D8432AACD79E7B8107D1FAB36140A20DA8310C5C6923E080284CD6
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\RYKhEanOwC6FWik4A4mJOAN8.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ipxaLwijnNCaFbKHMVglZ1Gv.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.979705429734299
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5SJ0pckhz6s:fE1cNwi23SJ8cul
                                                                                                                                                                                                                          MD5:2AE64AD36961AC9CA00C07DCECB43453
                                                                                                                                                                                                                          SHA1:A4D2BB0EFCB0780ED3C794EC7918D74E650F7958
                                                                                                                                                                                                                          SHA-256:66C728EF92CBCE6AA303FC1FA66D42BB2C3DCBC2583AA4CA6448146782BBDC86
                                                                                                                                                                                                                          SHA-512:2F1A03EBE675A511589EDFCB3836429F6B665205891E4A7C750FF7B51F5BF3AA48FB5ADF914AC8DA6A778AD394F341A0DE8A0F59C24F9F239624C380F9E0830A
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\wZdNhoVbOYgB7TrwJAsCrFOW.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jDlV6JCqkaaMXdj2ilRXIwiB.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.8454551686414185
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5PG0jU4R4m:fE1cNwi23Hum
                                                                                                                                                                                                                          MD5:A53BAACDAEA3C8B6FA4A86570855269E
                                                                                                                                                                                                                          SHA1:735BFF2E8CC653954E9E778BE7B60933739DD6E5
                                                                                                                                                                                                                          SHA-256:AC36F61F91C1B626035A5D7544C7101A1FB1F7FC9B515F8011CBB720EFDA7DF2
                                                                                                                                                                                                                          SHA-512:5DCDA858B9DB5D498AF1E0EC70D61162C945BFDDBF2F5AC73FF7DDD6EEEE5E1CF29A95244A7352DBA0360E630AF6E9A4F8BE848DC8E02C931959B08AC961951F
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\jeGjhHefWlrpFA9F19l2Ookm.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jLw9YTEqZHJtGfgAlmf6QvQQ.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.883193353602563
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5rqhdPV/GyxVMTQln:fE1cNwi23GNVRVXl
                                                                                                                                                                                                                          MD5:A4012D55DAFBCC486E91589187AD16CC
                                                                                                                                                                                                                          SHA1:E848FFFE74FC03D0AB8B3B9ADAE4CF407AD08573
                                                                                                                                                                                                                          SHA-256:85BC638E4045AF3C6F79B21EE86D2B52C1F9625E007FCCA67740E9CDCB4C73D3
                                                                                                                                                                                                                          SHA-512:2AA1B60A96860ADAA38C7433604405A0BC8A4D21AC5B14D2D4624100B3FD215C8D6C5EA185BE8FC4EC2C62057746440F61369C586A3E1DF0FA997628B86FF863
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\NPEDxjpZoYrdEERzjiUZxi6O.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jThuXZ4voJcJhbCjFEaBHzHv.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.926278929324846
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5Rcnu7VYLACHF:fE1cNwi230IYLVF
                                                                                                                                                                                                                          MD5:6811A88441ADF79C1D33496084D2CA55
                                                                                                                                                                                                                          SHA1:2E07342A69CFDE96C68BB58A118A8C9782C4271C
                                                                                                                                                                                                                          SHA-256:662D184E6F8E2543D696EAB6E16AFD723C07D733225BDA77A7B7287A14DD50BF
                                                                                                                                                                                                                          SHA-512:EF85F2673FCCB28EA0272D2EBEB3F6C5B9B3E73A561507B6E584368004C78A3D6AD688B92394E4BE0225296F050BB47CBD0AF953453F1124200E75743D5F52ED
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\t9bICacqM5w9awp82pyv2NWK.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jqBjaEhJsWFWAYj7GXVx0xrr.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.902710531743868
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5MEcgSWn:fE1cNwi23MEcgSW
                                                                                                                                                                                                                          MD5:7F08A67A2D95A20CF14B52C687C379D8
                                                                                                                                                                                                                          SHA1:80648CDA996B80C509D0CDA57B679BBB25D6F2C8
                                                                                                                                                                                                                          SHA-256:1A04492746DC9F8E04B39E3A8934AA22B7F5E071BF94437C1AA392F471CF42F9
                                                                                                                                                                                                                          SHA-512:203EA9F8C960F11BE9EE57A1F1792E5C87E2B404026449AA9DFD0718C3321E3BFCF72F54EC330384AA561CFDC3153CD178AC9D27A028A9EE78F2D35A127E82E7
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\iaqDCrpk7XgTBT3Gv3tL3MhD.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kGFe11FaCHj8Cq6LEsxAKO9Q.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):5.05791783993357
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5Us732WtJln:fE1cNwi23Us732qL
                                                                                                                                                                                                                          MD5:6D9D760358BAEFA8AEEAE54A5E66A611
                                                                                                                                                                                                                          SHA1:50FD6BAD51A0EE4332F63CB7BB99283D4ED70960
                                                                                                                                                                                                                          SHA-256:BD14AB06AA8A58FDA6C9BAB5892E89AB0073EA54FAAB2625406EFFEA1CC4D8F6
                                                                                                                                                                                                                          SHA-512:E604C3CCB4CB2DD34E498C0EA5D65F0F0DD1ED05B453FA2AE0D1B85840C46E4DBBD1304B7D1BDF71AF231899D26B5CE1C74BE53B9F2AB60F7C8BCDA3E4B66621
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\1IZVL6x1EXi1l4x68y4gFu3H.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kV5jXmTcsMiETlF8iRGxyKFt.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.992775698439381
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5wsE/6caf3sFiLAdAQWn:fE1cNwi23wsWKEFf9W
                                                                                                                                                                                                                          MD5:2E23B90A4E042879321CC0BFCABA8993
                                                                                                                                                                                                                          SHA1:DD4574A97A48924CD3DDEBA349385B6BE89FFCDE
                                                                                                                                                                                                                          SHA-256:F1F3C880805BBCA9F6399E5C31271F3DA2A4C0DB4DA23A7A7B039A5CA03EE18B
                                                                                                                                                                                                                          SHA-512:C6FA3F34CF7F6E669097D4110EFB2B04890E3E000BE5222616FD41F185C8B1E3C0170CF9270E83725BBA546076591128C93015949AF81E6F6CDE6D36DAAB9A18
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\UIgbZOdyaVSQ6RYQSEeprj5d.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l2UL1f1VQQ9TgewgTJp5cafq.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.972300944395517
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5VOw0MsrsAsKWn:fE1cNwi2350VgArW
                                                                                                                                                                                                                          MD5:891FB9EC12BECE87F7F8630F2FDE72B9
                                                                                                                                                                                                                          SHA1:37A33C0A5C32B2263E8B3E9122219021C36AE155
                                                                                                                                                                                                                          SHA-256:887FBB145EA0C0B292C061869314F166D02F71E1A46BCE9A1ABB454BD73E7A09
                                                                                                                                                                                                                          SHA-512:37A43AECB64F99A18887C0AB12BB7AD3E2516586AE8031E915A50966A85540B3756E72D6D3245AD9FD75B40F6559F46A4E6EA840967DCE2C89C2198900E99155
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\pkUUm3iviYyjVuVwVzn44HrC.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lKmPsTV4YA7CYpmS0qsQItFO.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.004172404736358
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5moIUdf1n0dmKWn:fE1cNwi23msfxk9W
                                                                                                                                                                                                                          MD5:A88DAA7EBC934344CECD369AB3D41209
                                                                                                                                                                                                                          SHA1:C7377C9BA3CB2E4C4AA46483FE68F4B3DB6657D9
                                                                                                                                                                                                                          SHA-256:31F1174731F44B4C5EBDD50663772E122B8A3DBA3B295AF659F01923EA15707D
                                                                                                                                                                                                                          SHA-512:1FFBDF8514AFC2F13CEE6BCB16EB045B08CF93FD68249540BF077C124D851999AA8E4F13DDB84A987CCC9A859515207D7627456FAC27E4EB2F87B3EFB1D97291
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\CUxLCA8x4ghROFTMPdaQB3M5.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lf37LKjOy1F8yH9htI5go57b.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.8988816690508745
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5wVaYw6SQJoCl:fE1cNwi23wVaYw3Ps
                                                                                                                                                                                                                          MD5:4E7B9E385287EF0002839EB7D2F176A8
                                                                                                                                                                                                                          SHA1:C66147449C995D6219EA94BE038AF066B8A4B036
                                                                                                                                                                                                                          SHA-256:287E35FA6A8348F62CEDE27D78E9D2EF6BCAAD83CA63F43E2C2A897A34AD8CF6
                                                                                                                                                                                                                          SHA-512:316D88F85412BFA311BB028BBB1C23F1A567CFEFCFB4203021BB52748196B9406F7BD150D744085613AFFBDE0CBECC3AEF2B120256A0E5E8A10BF66E3940B2A9
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\U7C9WzWkhs72ELqs0HGle9E1.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n16Ul2pmsPZpymsRFsDrzjOF.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.029507531801561
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5DnzfiHUUrLVwWn:fE1cNwi23PofSW
                                                                                                                                                                                                                          MD5:7191B5363D4AA4343925C5F3CDC906C8
                                                                                                                                                                                                                          SHA1:003848C1C4053F892CEA97E9A0992B0B10C63237
                                                                                                                                                                                                                          SHA-256:423AA3A7F7BE34127DBF1F92E8D89CE189FE7DA2C5CFA2BC5AB10A0333ECF299
                                                                                                                                                                                                                          SHA-512:D3CA1D90065A9F9D3270D65EF513A1D6C88A354C9BB1D1BBA01A9346F2E9677018EE6CDF7F486EBF5763DEF2EF67D2DE0E7255D264FBA6CC992596DB40187710
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\fw2TOiWzGo1NrFLSXdW9IHtr.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\p4mun4rwQavBk6vXf7mLPsDM.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.062366111091029
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5n5x+dYOqfJlKWn:fE1cNwi235xQJqf+W
                                                                                                                                                                                                                          MD5:F248ADA6395A2827D03E2E2AC0D3B7C6
                                                                                                                                                                                                                          SHA1:0FD11977FE4AB2AAF00552F3FBB3FE6546A40948
                                                                                                                                                                                                                          SHA-256:BD2CAD05278E8E4BFEFF391AA0E30B077D67B2CBAE7CE0FF39823ED6F5DFD0F8
                                                                                                                                                                                                                          SHA-512:43D763E770471843D9FD3F57E72AD55D7FF3B21945DDF8302154D2EB0ED7F798FC9C95A1027645AF6B0136E03951527EBF1FD7A021B1DB300C560C40DB5D32DF
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\BYMTdmumqdQRWdqfOhAEZ4m7.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pQK5jhKLuMPM67O36bjRAtlp.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.931272463250876
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5uhKHXskp2:fE1cNwi23uWp2
                                                                                                                                                                                                                          MD5:7B855E99C7B3806C35548BF00FDFDD59
                                                                                                                                                                                                                          SHA1:41BB9813F2D7B7A4BBF15185D33D90864BD911DB
                                                                                                                                                                                                                          SHA-256:853AD6C1F6DB0DFC5266A2F47BA5D71BA5BC2A22CACBE02B8F2086CFC9B5E28D
                                                                                                                                                                                                                          SHA-512:D59757781E574C9065B18E880504855F039F23DDA50C410B66BE363F3E327940ADA01AE3C484069B9AE9CE340FBB2B77B31934A9D35C488F685F05C1A097951E
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\K8xiKDxfY6nPxIYPlvgH1pTk.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pWYyEAMmGvRdSQiFkMbPsyKA.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.791612691271602
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5WVnEodqzrJFKWn:fE1cNwi23WZEAgdwW
                                                                                                                                                                                                                          MD5:9E1E59FB03C66FC87798C39564B37F6B
                                                                                                                                                                                                                          SHA1:910E93EDB7BBB87E5DE2E1E962B6F4E34086CC73
                                                                                                                                                                                                                          SHA-256:C497CE118CCECCBCDF0A8E75410D22403C16FBB8667501A1CC2C02B3AFC7F8F7
                                                                                                                                                                                                                          SHA-512:B0F356B3EDF20BD9BD82AB0D11E94831157AF753075F4082FD5869CD4E3DB6DEF50E02ACDB26B3703D4D3803DD767930EEC7BC9B418F328C782DFD6DE55375C4
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\3pU7us2lCosxu8OuPe4BpnIe.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pZxmHLS4YUZppdDnCbM54TVk.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):5.05654981979508
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5TtWmpNh5JFn:fE1cNwi235Wmpv5JF
                                                                                                                                                                                                                          MD5:A787F0CF25B95AA034EEF4F630476D20
                                                                                                                                                                                                                          SHA1:5510859C7F17018159C7766DC6962F617E662644
                                                                                                                                                                                                                          SHA-256:AFAC50B5B3CA21EE21969B0ECADDC0B7F630A61F7236F7CD45D7A1D80C15A28C
                                                                                                                                                                                                                          SHA-512:EF37CD6ED5ADC3A0419E2B43716F3FE019C630A7B3D35D520EF43E81612D2E4DEA4998E87CB06F4D0E07A06D5829FBF955639CB5C1E92E507EC4B3DB2EF2FF2B
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\6zadM3w0LYJNq0HAyB6c8Jvg.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qbbFZA8KUyY320BJKYkkQtYc.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.956043865077199
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5Tnz/CGUMEPjAsKWn:fE1cNwi23rlUMw8rW
                                                                                                                                                                                                                          MD5:89BA4770ABAE26ABED76886DE6A21058
                                                                                                                                                                                                                          SHA1:6D2AF1527C9BE5DDD62A883A99CF43A3A50967F3
                                                                                                                                                                                                                          SHA-256:6DDE155A142977DAB6AAF779A445C2B727CD4DB474B4E87C2BDBC8D4CC9598DC
                                                                                                                                                                                                                          SHA-512:05C1BCCCBB64C825123A6DD022A8BECAD3175365C53EFD5F45568720403DCC5F3D4BA9FA272F815010081609D7C8D514A248C17C218C9CEC628901ABEC0FDD18
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\6Se9cfVvgkgQ1LiWk4azwLiz.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sBSPGXFVGr9XmZ4KnrA6cgvt.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):5.001755299247133
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5VR/njPuK+Al:fE1cNwi237qK9
                                                                                                                                                                                                                          MD5:BFFEFE5EC5CE47AA78D4565F49C982C9
                                                                                                                                                                                                                          SHA1:7A9B741936A8CD052A3298A71FE49BF4DA463210
                                                                                                                                                                                                                          SHA-256:D63BA6ED22C7B4C06271CF97D613B16F1DC936AC23421A2F978E26B579FFEBD3
                                                                                                                                                                                                                          SHA-512:A6419C9BC139D89812A7C39C69B80F9B40363D02E733310DA38981CF170AD83A6F7F6EC32C69EE535EA7F0491388ADDE865281BE98AA7E3ACF80FE4FDFAC07B2
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\0tKUigrv8FZlFjBm6o7EVBkc.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sHRAIShzlUtV2Ej2KkHQUTd8.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.9433352649116475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5pUtlq/JUFHFn:fE1cNwi23qHn
                                                                                                                                                                                                                          MD5:FD0E5C0CA37507AA29E81F37CB54A6AA
                                                                                                                                                                                                                          SHA1:8E64B250F1A04512509BC89E2B450DD38E6C4B66
                                                                                                                                                                                                                          SHA-256:7E7B0D95D3E447F2AF2C66694525F833C554B27140A440637DA653DEDE05D00B
                                                                                                                                                                                                                          SHA-512:1FB976B20A75805EBA3F0A3B3691B582AA7CB5B96DAB39418F0F72C7777E5283083C8CEEBECC21171753413CEC30F698FF52A8EBCECDEE65B0EAA4F428238711
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\Lqzz8bYqWlL5siF3Zd6Xfpqn.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sM0pd9IgVzsfjezNSbt2hR8c.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.078967611062183
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5ScoyfHDTeF0sKWn:fE1cNwi23S1GHPk0rW
                                                                                                                                                                                                                          MD5:D0D8805B5733ADDA4320323BF0FE4C25
                                                                                                                                                                                                                          SHA1:811562104641F822C268CDC0EE84C674C66D6BC5
                                                                                                                                                                                                                          SHA-256:A46C03D7CBD16999CEB43D763493CB3C06B06735893317469F497ED79CE8921D
                                                                                                                                                                                                                          SHA-512:55523184800A9AD4515D6E8DDD9F93D0122FE1EE86ADC13399221F7B2EC4A7598689E1059FD02A0B1DB95B3ADE7BC99516AF0BD13008661DBA207BB95C7FDE95
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\7TZg7zlWDNnbBmFYTmmvpQh2.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sksCZf6BD8bmyHJVUY7BoElf.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.968772110975644
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5X4SW49fwdiwWn:fE1cNwi23ISW49qW
                                                                                                                                                                                                                          MD5:4BC2EFDD897C0D89A36E7840987B7643
                                                                                                                                                                                                                          SHA1:E12795C57BA6C1AB25F3C795175A8DDF1ADC0EDD
                                                                                                                                                                                                                          SHA-256:745DECE00242603052684BF0FDF2418E31B096C7E70545E334B04A8A9DE8EAE3
                                                                                                                                                                                                                          SHA-512:064F07636C4395C60840161E2B4ECAF1C2BA6D995F42CCB82578EC3DCA3257EE90AD8C68A72A82018726A57A7E50AFD6736DE6C4483380AA8F27598D224CFD40
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\2tcX737WHyo5lwEvmctv51Vv.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ssx35u7TOA2nPAp0L1L3IKsf.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.115699444424363
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5cgYqN23AdiwWn:fE1cNwi23cgYqo349W
                                                                                                                                                                                                                          MD5:6E800F9173289A5D95738E98416DE7C3
                                                                                                                                                                                                                          SHA1:BC863BF3ED412AD6B973B108275C2762BD03FBCF
                                                                                                                                                                                                                          SHA-256:66639D13BC88CB6648CB57E1F3C90F42133EF6518C58295CAA466EE9A46E7BA7
                                                                                                                                                                                                                          SHA-512:81B8757238D2741A101A9096252B1913E273D1B10110FFA3F88E2AAE7B5A66D07F81CCA7C83DAF91C38FF326E958854698C34D1C43D2FD4951132FA15CEA012F
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\yE7noGQXNcOT5zohTTwqK6bF.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tjY51tWJaahZmfQU8rSeUhVQ.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.1043027381273856
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5ss3UVkp4sLKWn:fE1cNwi23sRs4s+W
                                                                                                                                                                                                                          MD5:F2202765B9847DBF8A899F68D6D5F27D
                                                                                                                                                                                                                          SHA1:ECACF9F2381B724CF4D4BD4B7D95A64512317D13
                                                                                                                                                                                                                          SHA-256:C10179AAA7F474E07DE15F9A561A77118D2F86D8873AA3CF5DB4C398ED428CEC
                                                                                                                                                                                                                          SHA-512:AE2E0C09A8622556347F4B81CF3DB1E1991A65ECC912534FE285079C944AAD5FF68348A84FAF1658B7379FFA7C341C131C81A2085B98ADC7F7095A1AE62FB571
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\Ij1WDhMqibF1B2QU9vGntIlT.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uHnfZZZd2SrSzViwEQo8A2Zo.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.970969404794051
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J58Lz1s28wVSANHwWn:fE1cNwi238f1s28wEgHwW
                                                                                                                                                                                                                          MD5:2FD8DB2111A49B8327649E179272ED2F
                                                                                                                                                                                                                          SHA1:00D2FB71D44331C3BE9EC898DB6F23AFD18BD97E
                                                                                                                                                                                                                          SHA-256:B4F41A87BA3152BBED0E917E62317FD01144E2BC72BBEA0B4FFB38E5B3701D28
                                                                                                                                                                                                                          SHA-512:1C133E52F95CDFCEE8618D5C4343656B25AD6F129E2EEF917B19C989FA441F9EF0717FFA0623743C3282F03D8579ED012B9EDF56C67EEA9770B627A63914964E
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\YiBUNoJoPIhAtYOnilMSPvZS.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vYH2GBgutbYFV7StmqrF392h.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.970732525185621
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5KbTD2+wmKi3F0EFn:fE1cNwi23KbT3wmKi3GEF
                                                                                                                                                                                                                          MD5:698DE2DA7FE508BAAB5417C0B5A6C391
                                                                                                                                                                                                                          SHA1:DC86FE4EAC526868A6EA769A39809A7BC7A033E5
                                                                                                                                                                                                                          SHA-256:385ED5201A432723540CD7072A79152985F5F32C14C5468F7DABAB8DF2D21F34
                                                                                                                                                                                                                          SHA-512:CFF32AC0F86EA0D76F9AB18A042A98660FA2D4FCC709AE6196A55E48D0DDE484E4A7567804AA6920F27383C1B5C0EC3C61C7657EC6A82D2250B06C4E85B464EA
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\oPt6fSpHRKiTT7Q1TPCGqKkO.exe"

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vnAGf0bQ9J14q0sRMygGsW8l.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):5.115699444424362
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J5LcScuPJlKWn:fE1cNwi23wvO+W
                                                                                                                                                                                                                          MD5:F69928F0ADD62034B42E7ED1C1D87E16
                                                                                                                                                                                                                          SHA1:BBD8E93E686DA8A63A45BF81C50C2BA6EABF6FDC
                                                                                                                                                                                                                          SHA-256:7B27AC685C1DE1D4B7EBDD2637D760CD49FAD7E0C02D3211AB09D80FC241FD22
                                                                                                                                                                                                                          SHA-512:B8D05071AD876A4C9AA3BAA61AC02BA7A1F6A6CA5EEDB075EE916FE290D17D8E0265726E562645E7C1FFA5D86C3421F3CD86CDEC32EC016AA5B6862EDC355058
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\nPpyxVDuMw96yZmSf6gQ2TqY.exe" /s

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yrFSwTlmj7ddrNdTdahgfOKX.bat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75
                                                                                                                                                                                                                          Entropy (8bit):4.9355691110333355
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Ljn9m10nacwRE2J50gAbdz+UiFKWn:fE1cNwi230gAT9W
                                                                                                                                                                                                                          MD5:6F6717ACAE5F1B5A6A521C9E2B4F0A8B
                                                                                                                                                                                                                          SHA1:834215BB9241361577DC3010481F25505FB9822C
                                                                                                                                                                                                                          SHA-256:1CBDB0F12CB16E8B25E19DCCBBD474B6FA4CBE238A6E1B65C4A74A8B82F0EE39
                                                                                                                                                                                                                          SHA-512:05F6EACBB86C631E2F58BA765BEC925F58A6411DADE15A022EBEA5EAAC1AE39478B33B4B15930C91AA5DDC2F5EA73473FAF3B765E1FAC95B293F3F8896CD65A8
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:start "" "C:\Users\user\AppData\Local\Qs8gKU4lVOLm6RixkxRfa4V2.exe" /s

                                                                                                                                                                                                                          C:\Users\user\Pictures\0CtLUUWAoHtcou0zdP0CzCUj.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\0EWtjgbJif9Bin5wbnTDxdpr.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\1UJq8e2U2LX06ZYWItENFs3s.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\360TS_Setup.exe (copy)

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):104329184
                                                                                                                                                                                                                          Entropy (8bit):7.994786831397016
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1572864:rrhlntXB9C/S9UA7dhZ76B/MCQf7Z48YHkatX1lg8zOYr6BgUD82LEOtYI:HnGWUA7dhwB0F14JHkax128OYr6982N
                                                                                                                                                                                                                          MD5:B56AE4EF6D244BC96CE23A140FF0411E
                                                                                                                                                                                                                          SHA1:8306784137B831B808875A08ECE410116E0154B2
                                                                                                                                                                                                                          SHA-256:F88AE4717D54F92C3E939014C20B3C99FB968BE9E8092D09AF146C53CE884B48
                                                                                                                                                                                                                          SHA-512:A8AB91BE36DDDC3A6AA634F21F94927101CC6C4DEA65B4EFFDEC97598D97F52D60474E451D4B82AFF0249F07F18E330DDE1BF34D4AE269ED9CA20D5134AF8073
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................i.r......q......7.......g......`......7.......7.......n.............`.B....p......u.....Rich....................PE..L...(.Cf......................(.....K.............@..........................`8.....zs8...@..................................4..<....P...'"...........7.H)....6.L.......................................@............... ...\...@....................text...|........................... ..`.rdata...E.......F..................@..@.data........P.......4..............@....tls.........@......................@....rsrc....'"..P...(".................@..@.reloc........6.......5.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\360TS_Setup.exe.P2P

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:modified
                                                                                                                                                                                                                          Size (bytes):104329184
                                                                                                                                                                                                                          Entropy (8bit):7.994786831397016
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1572864:rrhlntXB9C/S9UA7dhZ76B/MCQf7Z48YHkatX1lg8zOYr6BgUD82LEOtYI:HnGWUA7dhwB0F14JHkax128OYr6982N
                                                                                                                                                                                                                          MD5:B56AE4EF6D244BC96CE23A140FF0411E
                                                                                                                                                                                                                          SHA1:8306784137B831B808875A08ECE410116E0154B2
                                                                                                                                                                                                                          SHA-256:F88AE4717D54F92C3E939014C20B3C99FB968BE9E8092D09AF146C53CE884B48
                                                                                                                                                                                                                          SHA-512:A8AB91BE36DDDC3A6AA634F21F94927101CC6C4DEA65B4EFFDEC97598D97F52D60474E451D4B82AFF0249F07F18E330DDE1BF34D4AE269ED9CA20D5134AF8073
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................i.r......q......7.......g......`......7.......7.......n.............`.B....p......u.....Rich....................PE..L...(.Cf......................(.....K.............@..........................`8.....zs8...@..................................4..<....P...'"...........7.H)....6.L.......................................@............... ...\...@....................text...|........................... ..`.rdata...E.......F..................@..@.data........P.......4..............@....tls.........@......................@....rsrc....'"..P...(".................@..@.reloc........6.......5.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\4WEUkBG9JpgzYkC7tR5gp4Pg.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\6HbUFGG6OprNlIY5JlVhXXii.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\6Yd84thjPkhRBN2b6a5H1jnf.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\8M7DUF3xBSx8QcSLemrdjOdg.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\8a30HwudqUc8B2I1TPgQnnUM.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\8gVu8gjepN333150vcek3LTo.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\8qKqy9BwD3yxFKs9FPzVbbUV.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\AP2lZUYLVb3fOVZjIJZoJ5uo.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\AcH6A3N4Yq3CItbLtQF82Zf4.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\BOYLJmOSydyd3al594lj0ZHm.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\HZo5cr670ciKVqx5K7ZScfqY.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\JbCzziprwhxu952EEGGM4kyy.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\Mwty6fi4Q3FKOsbAwfVnBGdO.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\Nzvx14A6i1YARb0z8nCWnXqc.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\PNRovpjvuoTBDQWgmW6Dxpeu.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\PQ7InkkMnF4WgBpnrK0fM12d.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\QdK9qeDGACGo9zbnCRy3mj3u.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\Qhn5Cs4iUiQe1fOLh3QZma5T.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\ReuFdz5VW3kSYWFmIhNeNe2A.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\S3AafgsV3ndWpGK20WkoNgGW.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\SsCm7Ag53eAdgIjMjAEokwsY.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\U3Oa50HVWGsdPmyCniC9yFFX.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\UDhWZlM2m146SXcde4F56BRT.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\V0KULW0eofKGKwAPoyk1jLfW.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\ZQJxXnmsk8IWrmEeNzFuMqjd.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\ZTC31vHrLGo214Qbz7YtQRrr.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\Zb7nxqblpw7TLWHsBMAvUPsl.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\aniaYFsW0PlkrlJ2YcSQ1uDn.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\bHE9XM1pSzemxpAUTAD74htE.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\cuOUlQ9A7hneJRyyE6akV0sd.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\duwqdISRLLAFoMl7eGQzvk19.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\eXYG01pvaO43Gh2ID1P8KBeF.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\gBwXmFsqSOHvlyhYsCkYMJOA.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\gfWrrNoU6cOZVXeoV8l1pMRW.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\jjsEbk9jQEccA6Qt56FDPpOc.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\kqmEb6pkblBuU3ikfPK4qcR5.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\nICxaxPOAPjSog9aqauyJ12l.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\nlajzL0nJsjGBoOzsEHar6xN.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\p0TVeG7PgzSYUEgCbGq9rvc9.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\r6B3NzCfMBGhJGaBBWOTeOOy.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\sYAdCucIdETYwti6zduaA4uc.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\tOjl1xMHwPniA98wveB6sp5S.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\tsPDoXjJ5QDVbxpQe7Ldx9O5.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\uvqLI8jE9ivm73yihaZdL8Gh.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\uwboAo9LPiCMDGo10JP3xX6M.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\valfJVofmQis2rSwBAURTfbb.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\vebo40yZZ14NTRA0bT2wbaOK.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1524456
                                                                                                                                                                                                                          Entropy (8bit):6.801769891654878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
                                                                                                                                                                                                                          MD5:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                          SHA1:BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
                                                                                                                                                                                                                          SHA-256:DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
                                                                                                                                                                                                                          SHA-512:06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\Pictures\xW9IehxgAMH1KYhEDWTYyuAV.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\z5etLqtnoYB3uq0Gp2ryNMWh.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Users\user\Pictures\z6PTVReHORuE0SANRIydUy3R.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7462
                                                                                                                                                                                                                          Entropy (8bit):5.420482116403958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
                                                                                                                                                                                                                          MD5:77F762F953163D7639DFF697104E1470
                                                                                                                                                                                                                          SHA1:ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
                                                                                                                                                                                                                          SHA-256:D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
                                                                                                                                                                                                                          SHA-512:D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

                                                                                                                                                                                                                          C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):55
                                                                                                                                                                                                                          Entropy (8bit):4.306461250274409
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                                                                          MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                                                                          SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                                                                          SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                                                                          SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                                                                                          C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                          File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1835008
                                                                                                                                                                                                                          Entropy (8bit):4.434190689232502
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:/cifpi6ceLPL9skLmb0mhSWSPtaJG8nAgex285i2MMhA20X4WABlGuNe5+:ki58hSWIZBk2MM6AFB0o
                                                                                                                                                                                                                          MD5:BA9A72B92B60E4C10EEC81BA494C673D
                                                                                                                                                                                                                          SHA1:D8BAE1D435069B9EDC47B873F05CF129B0F8B2EE
                                                                                                                                                                                                                          SHA-256:8053B2ABCECB7A8876B1EFF635BF83758EFEBBF17A884553B98C39424A706552
                                                                                                                                                                                                                          SHA-512:9925046859948857E6B4AFBB657CB7796873E364FEF6CE6534465075BA31562AF16C8FAA600C7D27FAE6F3F93D1140AA5FD5FA27275583E230C7F003650D74F8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Reputation:unknown
                                                                                                                                                                                                                          Preview:regfI...I....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....W...............................................................................................................................................................................................................................................................................................................................................{...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          Static File Info

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          File type:PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                          Entropy (8bit):7.952430779027075
                                                                                                                                                                                                                          TrID:
                                                                                                                                                                                                                          • Win64 Executable GUI Net Framework (217006/5) 49.88%
                                                                                                                                                                                                                          • Win64 Executable GUI (202006/5) 46.43%
                                                                                                                                                                                                                          • Win64 Executable (generic) (12005/4) 2.76%
                                                                                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.46%
                                                                                                                                                                                                                          • DOS Executable Generic (2002/1) 0.46%
                                                                                                                                                                                                                          File name:LisectAVT_2403002C_44.exe
                                                                                                                                                                                                                          File size:405'761 bytes
                                                                                                                                                                                                                          MD5:2427ff6ae2a31ddb6249669ce8e470cd
                                                                                                                                                                                                                          SHA1:bc54082f64c27b63ab35927b8b5b69f15518146c
                                                                                                                                                                                                                          SHA256:dc3f8a774e309c5f9789137fe97d0767da4399d09d5f7d4ec3c912409aaf4417
                                                                                                                                                                                                                          SHA512:7daa1e1609153f44352ab220a979d2c8417d01776fc238f0bfe9bcb8714f320cbf1eeb10bfd4e864918e78e20c0fb563750adbf8c298bc19e3ac305cf70e7390
                                                                                                                                                                                                                          SSDEEP:6144:9foVL+C+YZTWgnFaF7VVeTJuFi5YFvfYdAE2aJi3yeYKmMvfsNVY1cvG35y:9c9ZTWaFaFxVQ2YdAE2aJi3uKIN
                                                                                                                                                                                                                          TLSH:86841260B7C8A267E8DF5B725530958F0739F7E26886D52E68C250065CB7FE0CB26B13
                                                                                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....E..........."...0.&................ ....@...... ..............................rT....`................................

                                                                                                                                                                                                                          File Icon

                                                                                                                                                                                                                          Icon Hash:00928e8e8686b000

                                                                                                                                                                                                                          Static PE Info

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Entrypoint:0x400000
                                                                                                                                                                                                                          Entrypoint Section:
                                                                                                                                                                                                                          Digitally signed:true
                                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                                          Subsystem:windows gui
                                                                                                                                                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                          DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                          Time Stamp:0xC245A31E [Thu Apr 13 21:14:06 2073 UTC]
                                                                                                                                                                                                                          TLS Callbacks:
                                                                                                                                                                                                                          CLR (.Net) Version:
                                                                                                                                                                                                                          OS Version Major:4
                                                                                                                                                                                                                          OS Version Minor:0
                                                                                                                                                                                                                          File Version Major:4
                                                                                                                                                                                                                          File Version Minor:0
                                                                                                                                                                                                                          Subsystem Version Major:4
                                                                                                                                                                                                                          Subsystem Version Minor:0
                                                                                                                                                                                                                          Import Hash:

                                                                                                                                                                                                                          Authenticode Signature

                                                                                                                                                                                                                          Signature Valid:
                                                                                                                                                                                                                          Signature Issuer:
                                                                                                                                                                                                                          Signature Validation Error:
                                                                                                                                                                                                                          Error Number:
                                                                                                                                                                                                                          Not Before, Not After
                                                                                                                                                                                                                            Subject Chain
                                                                                                                                                                                                                              Version:
                                                                                                                                                                                                                              Thumbprint MD5:
                                                                                                                                                                                                                              Thumbprint SHA-1:
                                                                                                                                                                                                                              Thumbprint SHA-256:
                                                                                                                                                                                                                              Serial:

                                                                                                                                                                                                                              Entrypoint Preview

                                                                                                                                                                                                                              Instruction
                                                                                                                                                                                                                              dec ebp
                                                                                                                                                                                                                              pop edx
                                                                                                                                                                                                                              nop
                                                                                                                                                                                                                              add byte ptr [ebx], al
                                                                                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                                                                                              add byte ptr [eax+eax], al
                                                                                                                                                                                                                              add byte ptr [eax], al

                                                                                                                                                                                                                              Data Directories

                                                                                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x00x0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xc0000x596.rsrc
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x618180x18e0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0xa2740x38.text
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20000x48.text
                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                              Sections

                                                                                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                              .text0x20000x83260x8400f22e02ad4cb281be8383c2b59c7bbfebFalse0.5105054450757576data5.835095199435863IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                              .rsrc0xc0000x5960x600da8928f5ea9bdbe30e2f133df8c0a693False0.41015625data4.0285115574679775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                              Resources

                                                                                                                                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                              RT_VERSION0xc0a00x30cdata0.4230769230769231
                                                                                                                                                                                                                              RT_MANIFEST0xc3ac0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                                                                                                                                                              Network Behavior

                                                                                                                                                                                                                              ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                              Code Manipulations

                                                                                                                                                                                                                              User Modules

                                                                                                                                                                                                                              Hook Summary

                                                                                                                                                                                                                              Function NameHook TypeActive in Processes
                                                                                                                                                                                                                              SendInputINLINEexplorer.exe

                                                                                                                                                                                                                              Processes

                                                                                                                                                                                                                              Process: explorer.exe, Module: user32.dll
                                                                                                                                                                                                                              Function NameHook TypeNew Data
                                                                                                                                                                                                                              SendInputINLINE0xE9 0x9B 0xBB 0xBB 0xB6 0x64

                                                                                                                                                                                                                              Statistics

                                                                                                                                                                                                                              CPU Usage

                                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                                              Memory Usage

                                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                                                                                              Behavior

                                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                                              System Behavior

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:0
                                                                                                                                                                                                                              Start time:02:00:04
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Users\user\Desktop\LisectAVT_2403002C_44.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:"C:\Users\user\Desktop\LisectAVT_2403002C_44.exe"
                                                                                                                                                                                                                              Imagebase:0x25163b90000
                                                                                                                                                                                                                              File size:405'761 bytes
                                                                                                                                                                                                                              MD5 hash:2427FF6AE2A31DDB6249669CE8E470CD
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1541695751.0000025165D45000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:2
                                                                                                                                                                                                                              Start time:02:00:05
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                              Imagebase:0x7ff7b4ee0000
                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:3
                                                                                                                                                                                                                              Start time:02:00:08
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                                                                                                                                                              Imagebase:0x7ff7b4ee0000
                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:4
                                                                                                                                                                                                                              Start time:02:00:08
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\SgrmBroker.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                                                                                                                                                              Imagebase:0x7ff65c910000
                                                                                                                                                                                                                              File size:329'504 bytes
                                                                                                                                                                                                                              MD5 hash:3BA1A18A0DC30A0545E7765CB97D8E63
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:5
                                                                                                                                                                                                                              Start time:02:00:08
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                                                                                              Imagebase:0x7ff7b4ee0000
                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:6
                                                                                                                                                                                                                              Start time:02:00:08
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                                                                                                                                                                                                                              Imagebase:0x7ff7b4ee0000
                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:7
                                                                                                                                                                                                                              Start time:02:00:09
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                                                                                              Imagebase:0x7ff7b4ee0000
                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:8
                                                                                                                                                                                                                              Start time:02:00:09
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
                                                                                                                                                                                                                              Imagebase:0x980000
                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:10
                                                                                                                                                                                                                              Start time:02:00:09
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
                                                                                                                                                                                                                              Imagebase:0x7ff7b4ee0000
                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:11
                                                                                                                                                                                                                              Start time:02:00:13
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k LocalService -s W32Time
                                                                                                                                                                                                                              Imagebase:0x7ff7b4ee0000
                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:12
                                                                                                                                                                                                                              Start time:02:00:15
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                                                                                                                                                                                                                              Imagebase:0xd50000
                                                                                                                                                                                                                              File size:262'432 bytes
                                                                                                                                                                                                                              MD5 hash:8FDF47E0FF70C40ED3A17014AEEA4232
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:13
                                                                                                                                                                                                                              Start time:02:00:15
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                                                              Imagebase:0x7ff7b4ee0000
                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:14
                                                                                                                                                                                                                              Start time:02:00:15
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\system32\WerFault.exe -pss -s 460 -p 2440 -ip 2440
                                                                                                                                                                                                                              Imagebase:0x7ff696ce0000
                                                                                                                                                                                                                              File size:570'736 bytes
                                                                                                                                                                                                                              MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:15
                                                                                                                                                                                                                              Start time:02:00:15
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\system32\WerFault.exe -u -p 2440 -s 3156
                                                                                                                                                                                                                              Imagebase:0x7ff696ce0000
                                                                                                                                                                                                                              File size:570'736 bytes
                                                                                                                                                                                                                              MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:16
                                                                                                                                                                                                                              Start time:02:00:18
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                                              Imagebase:0x7ff7b4ee0000
                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:18
                                                                                                                                                                                                                              Start time:02:00:25
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:"C:\Users\user\Pictures\YBwX8KjTjRCKU7PVUt7ohrmo.exe" /s
                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                              File size:1'524'456 bytes
                                                                                                                                                                                                                              MD5 hash:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:19
                                                                                                                                                                                                                              Start time:02:00:25
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                                                                                              Imagebase:0x7ff7b4ee0000
                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:21
                                                                                                                                                                                                                              Start time:03:27:01
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:"C:\Users\user\Pictures\r0raHcCIH1k2YsFlLn2OIQyk.exe" /s
                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                              File size:1'524'456 bytes
                                                                                                                                                                                                                              MD5 hash:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:22
                                                                                                                                                                                                                              Start time:03:27:02
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 336 -ip 336
                                                                                                                                                                                                                              Imagebase:0xca0000
                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:23
                                                                                                                                                                                                                              Start time:03:27:02
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 984
                                                                                                                                                                                                                              Imagebase:0xca0000
                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:24
                                                                                                                                                                                                                              Start time:03:27:07
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:"C:\Users\user\Pictures\DD12FHVAYroWK47l2n2nUb6f.exe" /s
                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                              File size:1'524'456 bytes
                                                                                                                                                                                                                              MD5 hash:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:25
                                                                                                                                                                                                                              Start time:03:27:09
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1928 -ip 1928
                                                                                                                                                                                                                              Imagebase:0xca0000
                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:26
                                                                                                                                                                                                                              Start time:03:27:09
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 976
                                                                                                                                                                                                                              Imagebase:0xca0000
                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:27
                                                                                                                                                                                                                              Start time:03:27:13
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:"C:\Users\user\Pictures\87AZujGvMD0DS3bxBzittT7r.exe" /s
                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                              File size:1'524'456 bytes
                                                                                                                                                                                                                              MD5 hash:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:28
                                                                                                                                                                                                                              Start time:03:27:14
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6228 -ip 6228
                                                                                                                                                                                                                              Imagebase:0xca0000
                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:29
                                                                                                                                                                                                                              Start time:03:27:15
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6228 -s 976
                                                                                                                                                                                                                              Imagebase:0xca0000
                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:30
                                                                                                                                                                                                                              Start time:03:27:18
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:"C:\Users\user\Pictures\vG59IrPYDLqWmCOO9Pfbpgeu.exe" /s
                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                              File size:1'524'456 bytes
                                                                                                                                                                                                                              MD5 hash:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:31
                                                                                                                                                                                                                              Start time:03:27:20
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6844 -ip 6844
                                                                                                                                                                                                                              Imagebase:0xca0000
                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:32
                                                                                                                                                                                                                              Start time:03:27:20
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 984
                                                                                                                                                                                                                              Imagebase:0xca0000
                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:33
                                                                                                                                                                                                                              Start time:03:27:23
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aWJAM7LmGVjrqyGFkBX76m6y.bat" "
                                                                                                                                                                                                                              Imagebase:0x7ff7fe140000
                                                                                                                                                                                                                              File size:289'792 bytes
                                                                                                                                                                                                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:34
                                                                                                                                                                                                                              Start time:03:27:23
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                              Imagebase:0x7ff75da10000
                                                                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:35
                                                                                                                                                                                                                              Start time:03:27:24
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:"C:\Users\user\Pictures\7FamwTPi2SttiX4DgdTFvBP1.exe" /s
                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                              File size:1'524'456 bytes
                                                                                                                                                                                                                              MD5 hash:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:36
                                                                                                                                                                                                                              Start time:03:27:25
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Users\user\Pictures\360TS_Setup.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:"C:\Users\user\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=
                                                                                                                                                                                                                              Imagebase:0x320000
                                                                                                                                                                                                                              File size:104'329'184 bytes
                                                                                                                                                                                                                              MD5 hash:B56AE4EF6D244BC96CE23A140FF0411E
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:37
                                                                                                                                                                                                                              Start time:03:27:25
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4132 -ip 4132
                                                                                                                                                                                                                              Imagebase:0xca0000
                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:38
                                                                                                                                                                                                                              Start time:03:27:25
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 972
                                                                                                                                                                                                                              Imagebase:0xca0000
                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:39
                                                                                                                                                                                                                              Start time:03:27:30
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:"C:\Users\user\Pictures\5HEEZMiEnWqR242MeEoxlGRh.exe" /s
                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                              File size:1'524'456 bytes
                                                                                                                                                                                                                              MD5 hash:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:40
                                                                                                                                                                                                                              Start time:03:27:32
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jLw9YTEqZHJtGfgAlmf6QvQQ.bat" "
                                                                                                                                                                                                                              Imagebase:0x7ff7fe140000
                                                                                                                                                                                                                              File size:289'792 bytes
                                                                                                                                                                                                                              MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:41
                                                                                                                                                                                                                              Start time:03:27:32
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                              Imagebase:0x7ff75da10000
                                                                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:42
                                                                                                                                                                                                                              Start time:03:27:33
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Program Files (x86)\1721892447_0\360TS_Setup.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:"C:\Program Files (x86)\1721892447_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
                                                                                                                                                                                                                              Imagebase:0x3e0000
                                                                                                                                                                                                                              File size:104'329'184 bytes
                                                                                                                                                                                                                              MD5 hash:B56AE4EF6D244BC96CE23A140FF0411E
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Antivirus matches:
                                                                                                                                                                                                                              • Detection: 5%, ReversingLabs
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              General

                                                                                                                                                                                                                              Target ID:43
                                                                                                                                                                                                                              Start time:03:27:40
                                                                                                                                                                                                                              Start date:25/07/2024
                                                                                                                                                                                                                              Path:C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exe
                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                              Commandline:"C:\Users\user\Pictures\vjkQvA9A1258BKNJpE9OFR7r.exe" /s
                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                              File size:1'524'456 bytes
                                                                                                                                                                                                                              MD5 hash:CD4ACEDEFA9AB5C7DCCAC667F91CEF13
                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                              Disassembly

                                                                                                                                                                                                                              Reset < >

                                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                                Function 00007FFAACCD9DB0 Relevance: 2.0, Strings: 1, Instructions: 727COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: d
                                                                                                                                                                                                                                • API String ID: 0-2564639436
                                                                                                                                                                                                                                • Opcode ID: ae630aae55ddf46c95af5746426658309b97789372e2233853e1e4e15b5268d1
                                                                                                                                                                                                                                • Instruction ID: 3f176d7211398580b9c4bf07cd5fca1ee0ebac1ec4c00f985fcf4993d08b7f1b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ae630aae55ddf46c95af5746426658309b97789372e2233853e1e4e15b5268d1
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EC22677091DA898FF34ADF28D495AB177E0EF46310B0482BED49EC7197DE28E85687C1
                                                                                                                                                                                                                                Function 00007FFAACCDB16D Relevance: 1.6, Strings: 1, Instructions: 357COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: fish
                                                                                                                                                                                                                                • API String ID: 0-1064584243
                                                                                                                                                                                                                                • Opcode ID: 0cd5ec477e924f1328341b9e56a6ba92684e14dc8089cf9eaa865b081b6a0cb9
                                                                                                                                                                                                                                • Instruction ID: eed5b92d219be888239dfdf97c039456213520e2901adafdc9eb21da94817fd0
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0cd5ec477e924f1328341b9e56a6ba92684e14dc8089cf9eaa865b081b6a0cb9
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DDA13671A1CA498FF75DEF2898656BAB3D0EF96311B00457FE44FC3292DE24E81686C1
                                                                                                                                                                                                                                Function 00007FFAAD630E29 Relevance: .7, Instructions: 694COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1572190801.00007FFAAD630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD630000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaad630000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 6817a32e63d15e3308cd48ceec17901be7fe9239c12de7a729f200874605bc1c
                                                                                                                                                                                                                                • Instruction ID: bcf227205df17f11293df4becbfc886c68d6dc4aaa32f3702917d7e9e7cbad1a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6817a32e63d15e3308cd48ceec17901be7fe9239c12de7a729f200874605bc1c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4022F66191E7C58FE756DB3488555A57FB0EF57300B0941FAD4DDCB0A3EA2CA80AC391
                                                                                                                                                                                                                                Function 00007FFAAD63026B Relevance: 6.0, Strings: 4, Instructions: 1000COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1572190801.00007FFAAD630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD630000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaad630000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: 3J$3J$3J$3J
                                                                                                                                                                                                                                • API String ID: 0-3001255896
                                                                                                                                                                                                                                • Opcode ID: 016c0e89d8bfb1bae99b0b9acc8232a8a6c2f776a9dbddf82a735523f2fd34b9
                                                                                                                                                                                                                                • Instruction ID: c31a723730194cc6e2423bdb23417a4ae6ac6eea562db227188594bf83d5258a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 016c0e89d8bfb1bae99b0b9acc8232a8a6c2f776a9dbddf82a735523f2fd34b9
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2662E271C1E7C68FE756DB2888556A5BFE0EF53300F1985EAD0DD8B193EA28680DC781
                                                                                                                                                                                                                                Function 00007FFAACCDEBAA Relevance: 4.5, Strings: 3, Instructions: 767COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: I$SL_^$RL
                                                                                                                                                                                                                                • API String ID: 0-1380985997
                                                                                                                                                                                                                                • Opcode ID: 4d59b64e760caf5ecec26af2f47ff50e21ef94a57e2db7b7aaea5b3e7477d232
                                                                                                                                                                                                                                • Instruction ID: ace835934518a1384142ba592eba23a6a7b19626379011423205f2f7390b29e1
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4d59b64e760caf5ecec26af2f47ff50e21ef94a57e2db7b7aaea5b3e7477d232
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6E32EB6290E7858FE746AB7CA4556F97FE0DF47314B0841FBD08CCB193DE18984A8396
                                                                                                                                                                                                                                Function 00007FFAACCE4430 Relevance: 4.4, Strings: 3, Instructions: 680COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: P*%$P*%$P/%
                                                                                                                                                                                                                                • API String ID: 0-3113974968
                                                                                                                                                                                                                                • Opcode ID: ded7081d02df0a2b29cdd7b48c83adb09f9d9d76eb1566870ba048f5e77f1d60
                                                                                                                                                                                                                                • Instruction ID: 1cb4fa9d18462ba8410fa82557209c065e876111790bcc951f78dfca6cad874b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ded7081d02df0a2b29cdd7b48c83adb09f9d9d76eb1566870ba048f5e77f1d60
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 02125A72E0EA4A8FF3A9DFA8845567577C1EF87210B0481BDD44EC7292DF18E84A83C5
                                                                                                                                                                                                                                Function 00007FFAACCD1A99 Relevance: 3.0, Strings: 2, Instructions: 467COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: 0W%$#3M_^
                                                                                                                                                                                                                                • API String ID: 0-4174270866
                                                                                                                                                                                                                                • Opcode ID: 1cd86d6165145dd4073ef730948684af02ae811f675a08bd1e9a8c7feafa2a81
                                                                                                                                                                                                                                • Instruction ID: 5ca6590126b5b974869074243d54046b4cc9aece97dd7e93bb37f215dfcfa236
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1cd86d6165145dd4073ef730948684af02ae811f675a08bd1e9a8c7feafa2a81
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E3E10571A0DA498FF79AEF78C4557B97BE1EF85350F0041BAD44ED3292DE28AC168780
                                                                                                                                                                                                                                Function 00007FFAACCDFB72 Relevance: 1.8, Strings: 1, Instructions: 524COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: ^
                                                                                                                                                                                                                                • API String ID: 0-1590793086
                                                                                                                                                                                                                                • Opcode ID: 56af9e595f590f8a578a40b146ad5d2c7d3176501d14cedec30396c6629f1365
                                                                                                                                                                                                                                • Instruction ID: 350fd5b582619cc4c5c0537d4f64763a1b9ecfdfe1369e5480baf5bbf4f32819
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 56af9e595f590f8a578a40b146ad5d2c7d3176501d14cedec30396c6629f1365
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 450257A290D2965FE712BBBCF4A55F93FA0DF43228B0C51F7D08C8D093EF5864468699
                                                                                                                                                                                                                                Function 00007FFAACCDFBFA Relevance: 1.7, Strings: 1, Instructions: 480COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: ^
                                                                                                                                                                                                                                • API String ID: 0-1590793086
                                                                                                                                                                                                                                • Opcode ID: 35a4861b680c9d9817a3f3238f4ad42ea3c2d59b93068fdef7b18c189fea0853
                                                                                                                                                                                                                                • Instruction ID: 6bd863c269a68df4ddf27c84063bde509122d55414814ced6275907e87a587a0
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 35a4861b680c9d9817a3f3238f4ad42ea3c2d59b93068fdef7b18c189fea0853
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 39F134A290E2965FE712BBBCF4A55F53FA09F03228B0C51F7D0CC8D093EF5964468699
                                                                                                                                                                                                                                Function 00007FFAACCDF33D Relevance: 1.7, Strings: 1, Instructions: 422COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: p]%
                                                                                                                                                                                                                                • API String ID: 0-641334170
                                                                                                                                                                                                                                • Opcode ID: 3a921a8e103305b4e68cff422bfdd608c2537d44dc9019aad3c9408cae7cc462
                                                                                                                                                                                                                                • Instruction ID: 499cad97a3eff3fe9cdac11152a1b3dcd078604d3b3591454ffe2474bbeec9c6
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3a921a8e103305b4e68cff422bfdd608c2537d44dc9019aad3c9408cae7cc462
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A4C1C997A0E7924FF3426B7CA4AA6F57FD0DF43225B0841F7D08D8A093EF19944B8685
                                                                                                                                                                                                                                Function 00007FFAACCDF4FA Relevance: 1.5, Strings: 1, Instructions: 251COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: p]%
                                                                                                                                                                                                                                • API String ID: 0-641334170
                                                                                                                                                                                                                                • Opcode ID: 8492b6164d50c0987f482627c442947b68210a54b6826ff45b5a3dc276c42123
                                                                                                                                                                                                                                • Instruction ID: f37f5072548d95b5eef47a6927e30a1432740efb2f1373373cf960ddf2f277fb
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8492b6164d50c0987f482627c442947b68210a54b6826ff45b5a3dc276c42123
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5471F8D2A1E7824FF3556B7CA46A6F97FD0DF47224B0841F7D08D8B093EE19A8078285
                                                                                                                                                                                                                                Function 00007FFAACCDACB0 Relevance: 1.5, Strings: 1, Instructions: 228COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: d
                                                                                                                                                                                                                                • API String ID: 0-2564639436
                                                                                                                                                                                                                                • Opcode ID: b758ed68d9eaafed519fe758c9f6715ce283bfbb23f0fd5fe98c1b0d56e0c9ee
                                                                                                                                                                                                                                • Instruction ID: 3c626084482c5568ad65465e5971f60418ad685aa5808e33e1229bccdd21ef7b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b758ed68d9eaafed519fe758c9f6715ce283bfbb23f0fd5fe98c1b0d56e0c9ee
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6761D170A29A498BF74DDF18D491A7173E0FF46304B1081BAD94EC729BEE25F86386C1
                                                                                                                                                                                                                                Function 00007FFAACCDE4E8 Relevance: 1.5, Strings: 1, Instructions: 213COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: aL_I
                                                                                                                                                                                                                                • API String ID: 0-3917316977
                                                                                                                                                                                                                                • Opcode ID: 3eeb181ddff539acd0322257da10baf4179b78f2b15f3ac7794d9ba4e32bce59
                                                                                                                                                                                                                                • Instruction ID: 743630bbc3f3a8a0479d23f345cdcaee1dfdbab38f782c7e245888449475ec2d
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3eeb181ddff539acd0322257da10baf4179b78f2b15f3ac7794d9ba4e32bce59
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7951EB9291EBD18BF216576C68551FD6FE0EF4622470881FFE08C8F0DBE914D94A87C6
                                                                                                                                                                                                                                Function 00007FFAACCDD606 Relevance: 1.5, Strings: 1, Instructions: 209COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: ;0
                                                                                                                                                                                                                                • API String ID: 0-4267330312
                                                                                                                                                                                                                                • Opcode ID: 7cd6ac5ddc268823c6da5d51a374e35fcdb0f199cbbbb227b656d3c1a0827cc9
                                                                                                                                                                                                                                • Instruction ID: 58b882b25ca393d96579ce4c9d5a2ec999a7a35a188a6ccb00ef869edadc8ee9
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7cd6ac5ddc268823c6da5d51a374e35fcdb0f199cbbbb227b656d3c1a0827cc9
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0A61D235D0991A8FEB89DF24C480BE973E1FF55304B1146BAD01EDB19ACA24E85AC7C0
                                                                                                                                                                                                                                Function 00007FFAACCDFEFA Relevance: 1.4, Strings: 1, Instructions: 197COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: ^
                                                                                                                                                                                                                                • API String ID: 0-1590793086
                                                                                                                                                                                                                                • Opcode ID: b4299c6a68b5bd518bf6de615bce1cd263adaf92a61909b898ce9c947084d179
                                                                                                                                                                                                                                • Instruction ID: 6bb6408c722554c8b1734d476eb9f4513be88fff381d97e604940dc089e63e4b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b4299c6a68b5bd518bf6de615bce1cd263adaf92a61909b898ce9c947084d179
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 925199A290D2968FE712BB7CF4A55F93FD0DF43229B0841F7D0CD8A093EF1964468289
                                                                                                                                                                                                                                Function 00007FFAACCD13F2 Relevance: 1.4, Strings: 1, Instructions: 189COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: @nZ
                                                                                                                                                                                                                                • API String ID: 0-3247533169
                                                                                                                                                                                                                                • Opcode ID: 2982a6cb9e8d78be8f811011f4a50d7872959d9fa40e697a644dca56057d09c9
                                                                                                                                                                                                                                • Instruction ID: 4ed088961196f29f5c96b706e27c272e938b7a3ffd63aaf3001b3b9aa6dc47fa
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2982a6cb9e8d78be8f811011f4a50d7872959d9fa40e697a644dca56057d09c9
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C55118B172DA894FE756EB2C84557B57BE1EF99321B4442FBD04EC71A3DD28D80A8380
                                                                                                                                                                                                                                Function 00007FFAACCD1E2F Relevance: 1.4, Strings: 1, Instructions: 156COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID: M_H
                                                                                                                                                                                                                                • API String ID: 0-3155224200
                                                                                                                                                                                                                                • Opcode ID: 1ff174ce649e458c147e291133e55e1ca09f9004d54ff177f2b50d7856e13c6b
                                                                                                                                                                                                                                • Instruction ID: 88db9c9966fa0347081719d6eddeffc6f48a668430da64e629282376f837fd5a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1ff174ce649e458c147e291133e55e1ca09f9004d54ff177f2b50d7856e13c6b
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4341B57171984D8FEB85EB6CC459BB877E2EF9A31071541BAE04EC72A2CE24EC468741
                                                                                                                                                                                                                                Function 00007FFAACCD898D Relevance: .5, Instructions: 514COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: dd762809e8500cf8da170ffcd6e583a92f4643a084dccd6a34e29bac21401149
                                                                                                                                                                                                                                • Instruction ID: 5c32803b7177e5389e60cecf25b85902ab05bbddfbb7ca7bddae01adc57de267
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dd762809e8500cf8da170ffcd6e583a92f4643a084dccd6a34e29bac21401149
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 73E1027191EB858FE31ADB2888515B1BBE1EF5731071485BAD08FCB593DB28E846C7C1
                                                                                                                                                                                                                                Function 00007FFAACCDD3C0 Relevance: .5, Instructions: 451COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: e5d4ff75dee4c8dd5d763df3f61b79ada15178be0926fd9db8ddcb0c71d66382
                                                                                                                                                                                                                                • Instruction ID: 9e9f36ed23a78b4e495ff70fa541b05ddbc947501b8407044fed6ae9534e7b43
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e5d4ff75dee4c8dd5d763df3f61b79ada15178be0926fd9db8ddcb0c71d66382
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 94E1F234909A5A8FEB99EF28C841BE977E1FF55304F1045BED00EDB196CA24E85AC7D0
                                                                                                                                                                                                                                Function 00007FFAACCDA6F1 Relevance: .4, Instructions: 448COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: e68f9488b10ea3bc6f4c18fc71fb8c0372d9cff6d48e1ba714cd376bc915d945
                                                                                                                                                                                                                                • Instruction ID: f7ac435f16c1c4d47880a6635d3c7851a05491ad8dad3d49b1284fec33f2a57b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e68f9488b10ea3bc6f4c18fc71fb8c0372d9cff6d48e1ba714cd376bc915d945
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 63C16D21A1DA568FF31A8F1498912B577D1EF82711B58827FD08FD7186DE2CF89782C0
                                                                                                                                                                                                                                Function 00007FFAACCD99FA Relevance: .4, Instructions: 425COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 91210e771f720b6aee0228ef754313baa9611ad8a79cfeb89d1bf7f42708cc7a
                                                                                                                                                                                                                                • Instruction ID: ff3563addc79fed0ffd7df27f61cc36e5665e292a49d88de7a729ba216bed42c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 91210e771f720b6aee0228ef754313baa9611ad8a79cfeb89d1bf7f42708cc7a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D8C11456A1E6C68BF3276B7858912B47FD0EF43215B1981FBC0DD8B483FD0DA85A8391
                                                                                                                                                                                                                                Function 00007FFAACCDD1B7 Relevance: .3, Instructions: 260COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 2970482f205aca962cab96711dd599c24d2b687507b6b8e798223f300135e945
                                                                                                                                                                                                                                • Instruction ID: 761a4bdb425f39777b02bb27374a899a2830f7b8e8b4e95c33197900973ec3d3
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2970482f205aca962cab96711dd599c24d2b687507b6b8e798223f300135e945
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7E712676E0826A8BE754AF2CE8417F977A0EF86335B10417BD14CDB082DA25F85B87D0
                                                                                                                                                                                                                                Function 00007FFAACCE029C Relevance: .3, Instructions: 258COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: c3292437eb2aadb9c77a5af2b09f57d830dcf905263705fc8a0aee9d9bdbcf9d
                                                                                                                                                                                                                                • Instruction ID: 44060d3d326cdd3943d41e45012afb274a29bfe1cd30135a8aaa1333b9709210
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c3292437eb2aadb9c77a5af2b09f57d830dcf905263705fc8a0aee9d9bdbcf9d
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3771EC30A1EA858FE729DF2888815B1B7E1EF56300B1485BED09FC7592DA25F8478BC1
                                                                                                                                                                                                                                Function 00007FFAACCD9E6F Relevance: .3, Instructions: 252COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: d998c7b7a9cd382dfdcc2ed09af0fb0e89e2b10f392db900f766db47430547ee
                                                                                                                                                                                                                                • Instruction ID: 21b30a916d3e8cf037ba2e8d8507734712eb4b327432edc117e22f9c21247bb0
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d998c7b7a9cd382dfdcc2ed09af0fb0e89e2b10f392db900f766db47430547ee
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2171A39690FBC28FF2568BAC58162787FD1EF53524B4C81BBD08D4B097ED19A91983C3
                                                                                                                                                                                                                                Function 00007FFAACCD8990 Relevance: .2, Instructions: 250COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: c37ea9d56d5e6a0d25ce6fcd38e6a080f8688a41deeb98726b01b041180ff7d5
                                                                                                                                                                                                                                • Instruction ID: d47dff3045e37551c66ed8fdc148ec768c7f729f6a34b8ed03a3ee4fa6f27d71
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c37ea9d56d5e6a0d25ce6fcd38e6a080f8688a41deeb98726b01b041180ff7d5
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BE71ED30A1AA458FE729DF28C8815B1B7E1FF56300B1485BED09FC7692DB25F8478AC1
                                                                                                                                                                                                                                Function 00007FFAACCDDF60 Relevance: .2, Instructions: 239COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: c2391def4292a7f6954e6ff2721066e13069f3e6f39581bcc2fbef5c1a245478
                                                                                                                                                                                                                                • Instruction ID: 83c3560177eaedb48a4c34891c53215fb981f229812583da5eaf28f421817272
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c2391def4292a7f6954e6ff2721066e13069f3e6f39581bcc2fbef5c1a245478
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C971D730A1961E8FEB4ADF14C480AB9B7B1FF85304B14857AD01DC7286DA35F896C7C1
                                                                                                                                                                                                                                Function 00007FFAACCDAF35 Relevance: .2, Instructions: 238COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 900593c49e94d856e1073bed78fa0a38c8a895104ab4074e122428b708b8d6dd
                                                                                                                                                                                                                                • Instruction ID: f2b8d9ea98cc240c7e61f06931b6e513ce27f396c1685422ded3d7fa9ebec21c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 900593c49e94d856e1073bed78fa0a38c8a895104ab4074e122428b708b8d6dd
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A061F43160EA198FF768EF1DD4556FA37D0EF86311F1441BAE48EC7192DA28E84987C1
                                                                                                                                                                                                                                Function 00007FFAACCE9870 Relevance: .2, Instructions: 238COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 5848e138a1f92121f08466297f3197cf1fda6dead051d55f54d4084d40f138b8
                                                                                                                                                                                                                                • Instruction ID: 1f3244509b1a30c75f24d9a37fa50a8435bf32793d397358b840a11d6a7b0c56
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5848e138a1f92121f08466297f3197cf1fda6dead051d55f54d4084d40f138b8
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C461057190D98C8FDB88EF5CC455AF9BBE1EF5A310B0441ADE04EC72A6DE24EC468781
                                                                                                                                                                                                                                Function 00007FFAACCD9E90 Relevance: .2, Instructions: 212COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 523fd16a0ed984d0c8354f8a5d3dba93ddfa1e1b1058846c173d4954f0547f05
                                                                                                                                                                                                                                • Instruction ID: 2a797ef35b188a64e41290d53bf3115b79a8b5e9d313b1873aa48107b3809d5e
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 523fd16a0ed984d0c8354f8a5d3dba93ddfa1e1b1058846c173d4954f0547f05
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6A61B38690FBC28FF6564BAC581627C7FD1AF53514B4C81BBD08C4B09BED19A91983C3
                                                                                                                                                                                                                                Function 00007FFAACCD26C2 Relevance: .2, Instructions: 182COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: f661878622f3322390b2b4741128143dd4ebe4b74c2a17b95d780c66e1a7abc9
                                                                                                                                                                                                                                • Instruction ID: 34988f3d710521339f88c98d80b1dc7bca1eac2acd25a67f7f200ef1ef807ae3
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f661878622f3322390b2b4741128143dd4ebe4b74c2a17b95d780c66e1a7abc9
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C8516C71E0991D8FEB96EF68C4553BDB6A2FF89311F14817BD00DD3291DE28AC968780
                                                                                                                                                                                                                                Function 00007FFAACCDA589 Relevance: .2, Instructions: 150COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 89b5492a2d7629c9181e8520aeee76f5c3b9975060e7f7be716ddf30fbfd0f45
                                                                                                                                                                                                                                • Instruction ID: 66ee75e7d8e7da32aac4957baa9b807f636f364db0101a60f25d2418efcaf70d
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 89b5492a2d7629c9181e8520aeee76f5c3b9975060e7f7be716ddf30fbfd0f45
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 77412A52A0DA868FF79A9B3898593B83BD0EF56711F0841BBE04DC71D3DE1C984987C2
                                                                                                                                                                                                                                Function 00007FFAACCDA1E0 Relevance: .1, Instructions: 144COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: dffbf7939d09a3d8841da96df8de8271338da2a754d6b3143c2cf19cf52eee8f
                                                                                                                                                                                                                                • Instruction ID: f86e7823eef508d4924d1449e1c14ff12033d380214d6eb44bc8c3e3b1636c30
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dffbf7939d09a3d8841da96df8de8271338da2a754d6b3143c2cf19cf52eee8f
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 15410971A0AA499FEB49EB7884667FD7BE1FF4A301B0401BFD00ED7192CE2998158741
                                                                                                                                                                                                                                Function 00007FFAACCDAF98 Relevance: .1, Instructions: 141COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: c55170d0d952332bc57caaa17c6d5ec44ce5cd6c39e1b2ccc1ff27b5bb5b5560
                                                                                                                                                                                                                                • Instruction ID: 6726805f5a9264a35134f70646e9389b762f04b1209f722ec36b4e2e6bca4b06
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c55170d0d952332bc57caaa17c6d5ec44ce5cd6c39e1b2ccc1ff27b5bb5b5560
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A141263011DA968FE74E9B2888545B57BE0FF46301B0545FFE08ECB2A3DA2CE955C381
                                                                                                                                                                                                                                Function 00007FFAACCDFB40 Relevance: .1, Instructions: 124COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 0dc3e757c1b1747b4a6360d9d8836d02c294b491ddffb906b7805497a60db3aa
                                                                                                                                                                                                                                • Instruction ID: 6acdd426486f0ffe2b4c4b53fff27bfeb045e332f7b05538952722d702d11d76
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0dc3e757c1b1747b4a6360d9d8836d02c294b491ddffb906b7805497a60db3aa
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A441B870906A5D9FEB94FF68C4596B97BF0FF1A301B0005ADD44ED71A1DB74E9448B80
                                                                                                                                                                                                                                Function 00007FFAACCDA234 Relevance: .1, Instructions: 116COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 0e747766ec18c9f7cc3d5c684f475923c37dface41de64c9ba6b7a71f42c376d
                                                                                                                                                                                                                                • Instruction ID: 2fd3d816aa4e4fe7307a544ef230212bff69d055a4a587d05b7c13e7f5c6178c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0e747766ec18c9f7cc3d5c684f475923c37dface41de64c9ba6b7a71f42c376d
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8831D870B19A498FEB49EF7884626F8B792EF4A30074441FED00FD7292CE29D4158741
                                                                                                                                                                                                                                Function 00007FFAACCDA1BD Relevance: .1, Instructions: 94COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 64fed90f2fe33bc53abad8d81c47ea7cff447625297046e154f5f1aff8ee7ce3
                                                                                                                                                                                                                                • Instruction ID: 7131757efec23efabdf57f1fe93639209c3c963b4263b912a9d1e6176a407df0
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 64fed90f2fe33bc53abad8d81c47ea7cff447625297046e154f5f1aff8ee7ce3
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B9212B7190E789CFE745AB7858192A87BF0EF56211B0841F7D00DC7193EE2C9C598792
                                                                                                                                                                                                                                Function 00007FFAACCDD443 Relevance: .1, Instructions: 91COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: f625ba86f8c14a19445005a094a43ed55733f390d453f13a02bbb0b0678339c7
                                                                                                                                                                                                                                • Instruction ID: 9476ef4fa59bbb096d719481cbdf726fe378626ef926dfce1d4e4d341d229dfa
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f625ba86f8c14a19445005a094a43ed55733f390d453f13a02bbb0b0678339c7
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5521F734A0A65A8FEB5EDF2488507B97391EF46300B5045BEE45ECB2C6DD24F81B87C0
                                                                                                                                                                                                                                Function 00007FFAACCDA41D Relevance: .1, Instructions: 90COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 2910772ac4e5f37f2d74f9b4ae9186854c314c2e5686c754e5132b96236034dd
                                                                                                                                                                                                                                • Instruction ID: 92688eade416849b3dc3e9e033acd06c0880f548d0fae582b7f01c25e6d4730a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2910772ac4e5f37f2d74f9b4ae9186854c314c2e5686c754e5132b96236034dd
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 292149B190E6899FD74AAB7848662FD7BD0EF46211B0441FFD04ED7692CA2C98198381
                                                                                                                                                                                                                                Function 00007FFAACCD9DF8 Relevance: .1, Instructions: 86COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 2f9864c0665033dd4b35f55e44600fe1119a7237d7fb13fae8b3289808bd3d33
                                                                                                                                                                                                                                • Instruction ID: 06d3209de8855c1257076633ab0e7797b5704a1be4353e9abe10842f41819c36
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2f9864c0665033dd4b35f55e44600fe1119a7237d7fb13fae8b3289808bd3d33
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 06214B7090E6895FD745AB78485A7FD7BD0EF46201B0045FFD04ED7292CE2CA419C381
                                                                                                                                                                                                                                Function 00007FFAACCDBBE5 Relevance: .1, Instructions: 80COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: b9a7c24f0c2a7b3a47b42ade5096a3adc65d520dd78519d954fb3391ee932a51
                                                                                                                                                                                                                                • Instruction ID: 24804d4cb584970298f5a9ef62141133cff9bd804e098b2d72870e410ae37367
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b9a7c24f0c2a7b3a47b42ade5096a3adc65d520dd78519d954fb3391ee932a51
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9C213B7150DB845FD382DB2858546A57FE1EF8F221B1803BBE48CC72A3DA24D945C3C2
                                                                                                                                                                                                                                Function 00007FFAACCDE66A Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: b2540954f43b38f5bac841454d9c047c0c01f773a16512be7d5238a7f18dc56b
                                                                                                                                                                                                                                • Instruction ID: f578772968c891b0f3a2d36ae51ca790f9e8ef4b04cb0a7e3c5103950c67f973
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b2540954f43b38f5bac841454d9c047c0c01f773a16512be7d5238a7f18dc56b
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AC11C13160DA5A8BF78AAB2884542B936D1FF89305F44457FE48DC72D2DE2CDA958381
                                                                                                                                                                                                                                Function 00007FFAACCD9949 Relevance: .1, Instructions: 67COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 71a196ebb32e000f12667da4ad6ee0d97b4832d62880084c6dbef7c9f46181bf
                                                                                                                                                                                                                                • Instruction ID: 4127de93427ce1da44ada6e483570226619ca560548a42e1778e586b3800f136
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 71a196ebb32e000f12667da4ad6ee0d97b4832d62880084c6dbef7c9f46181bf
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AB112932B096454FD3459F6C58462E5BBD1EFCA22070882BBD40DC7266ED29985B83C2
                                                                                                                                                                                                                                Function 00007FFAACCD0498 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 8c403776b06887df9ad95d8aa492bee9a6f5dd85e96c9f801503201a962d41fc
                                                                                                                                                                                                                                • Instruction ID: 50776a390356a6f50d407f351ebc58481acca5247c9b4fafd6a14cfa91701882
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8c403776b06887df9ad95d8aa492bee9a6f5dd85e96c9f801503201a962d41fc
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C5112522B0E5854FF7669B781C661AA6FC0EE8612471446FFD45EC72D1E81C98868381
                                                                                                                                                                                                                                Function 00007FFAACCD9CE8 Relevance: .1, Instructions: 62COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: c7f57690fa34b57a86e79200557089a4683446bf87c811b46c045eb91c06b9af
                                                                                                                                                                                                                                • Instruction ID: b5437bbdd2c192d6693cffdcd24f8c6fa66db7bf825a2b43db8e642bd5729c98
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c7f57690fa34b57a86e79200557089a4683446bf87c811b46c045eb91c06b9af
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9F014762B0E6480FE201BB7CB8924F53BD0DF8722AB0841FBE08DCA153DD19944682CA
                                                                                                                                                                                                                                Function 00007FFAACCDAF90 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 8a0b2fca549659b1fdae18e9bd27e117e9ac4cf2f0f3ef374efc163df8fa1dc5
                                                                                                                                                                                                                                • Instruction ID: 6eff1dffba2b468cbbde50e3ca83a6bc52b7ee156fe3265da431dc4b4b6ee993
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8a0b2fca549659b1fdae18e9bd27e117e9ac4cf2f0f3ef374efc163df8fa1dc5
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 87110C31E0950E8BEB66DF5894457FEB6F5EB49300F10843FE12DE2280CA34A969DBD1
                                                                                                                                                                                                                                Function 00007FFAACCD2B32 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 704567be7877f91cc11212db903a7f813789067d552f4108191108321ab6e5b0
                                                                                                                                                                                                                                • Instruction ID: ed870175225c727fb6bb39abf50a80f8cd075ec49da4183529bced5e4549b24e
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 704567be7877f91cc11212db903a7f813789067d552f4108191108321ab6e5b0
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BA01B54194F7C25FE3979778086A5A63FE28E8702070941EFD489CB5A3D88D5C4B8352
                                                                                                                                                                                                                                Function 00007FFAACCD1C2B Relevance: .1, Instructions: 53COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 539ae4426a7b6ffaeb7ddf96b4eb426d0920d8c2cff3e0c3d2e0b0410726dd82
                                                                                                                                                                                                                                • Instruction ID: 895cf3affe9d1a139cf78c43c9f7e1acd0eb04a23b2cfa2c790a742f68d4f304
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 539ae4426a7b6ffaeb7ddf96b4eb426d0920d8c2cff3e0c3d2e0b0410726dd82
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4011CAA1D195894EE707FBF0C4A6AFDBBA0AF15300F4045FED04DDB092EE2C54558341
                                                                                                                                                                                                                                Function 00007FFAACCD0833 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: adef280e6adfbcc4311195f6c802c0522fc7eb680e78da99efa988592a5b5df6
                                                                                                                                                                                                                                • Instruction ID: 81ec43c0848025a83d2d1932832495fef4bd4271a80c0ccd2f207456e251811a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: adef280e6adfbcc4311195f6c802c0522fc7eb680e78da99efa988592a5b5df6
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7911CE8190F7C6AFE357273848A50A5BF60AF6321070946FFD4D98B093DC09A82CC392
                                                                                                                                                                                                                                Function 00007FFAACCD93C9 Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 036b1ee56568373a5231e906b8a02f6f920c34d5a165c40d887416bde050a09c
                                                                                                                                                                                                                                • Instruction ID: b6caaa18ecc4a01cee290d1da43ba358825bc99315407a79e50f1df006c90b3a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 036b1ee56568373a5231e906b8a02f6f920c34d5a165c40d887416bde050a09c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A701493150DBC94FD386DB18D4606A67BE1FF89210F88057FE08DC3292EE69D9088382
                                                                                                                                                                                                                                Function 00007FFAACCDE3F2 Relevance: .0, Instructions: 48COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: de5ff6cb465e754c17ca17ee81b6def2ec8f680a42ffe437abb374bf343b69d2
                                                                                                                                                                                                                                • Instruction ID: 47c9699358c0c5d01ca7eafb14543fc53f1c6eb63b904da3f67b53bf021ee9f6
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: de5ff6cb465e754c17ca17ee81b6def2ec8f680a42ffe437abb374bf343b69d2
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3AF04C62E19E5A4BE364EE2CA4461F9B7D0DF85320300867FD4DEC2242DF18A80702C1
                                                                                                                                                                                                                                Function 00007FFAACCD1C19 Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: dad2e9f7c75ce169117a242d02b8f3fc66b888afe1c5a9683646fda48e9297b6
                                                                                                                                                                                                                                • Instruction ID: 341570dcbfa226efb1ddf9688a9d360a937a5889a5f41bec51ae5ce146608a73
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dad2e9f7c75ce169117a242d02b8f3fc66b888afe1c5a9683646fda48e9297b6
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9D0192A1D0E58A4EF70BEBB4C4A66BCBB90AF16350F4445FED04EEB192ED1C64194381
                                                                                                                                                                                                                                Function 00007FFAACCD1A39 Relevance: .0, Instructions: 42COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 6da073d34969c9941da09d9d4983da80222ed6a6e8c119bf71fe927f80f3379a
                                                                                                                                                                                                                                • Instruction ID: 610b529fa846c2e3dea76dfdd6402839c825992c392c48d8823f1069890a60d7
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6da073d34969c9941da09d9d4983da80222ed6a6e8c119bf71fe927f80f3379a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A6F0786180D3C88FE3429F3888251A9BFB0EF07210F0400EBD00DC70A3EA2849998382
                                                                                                                                                                                                                                Function 00007FFAAD631BD6 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1572190801.00007FFAAD630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD630000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaad630000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 5b7e8dae34cb8b81c5d1e82468d1f0e782711ff901277d0ae3b38f0a26fa54ca
                                                                                                                                                                                                                                • Instruction ID: ee9857f74a53ead1b019fb73c3bf69e4f1926513aaa17e34ed5443017830c454
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5b7e8dae34cb8b81c5d1e82468d1f0e782711ff901277d0ae3b38f0a26fa54ca
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0301FB31A09569CFDB65DB08C885BDDB7B0FB68301F1081EAC08DE3511DB35AAC59F80
                                                                                                                                                                                                                                Function 00007FFAACCDA169 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: fa3561d5b866aa53c00a42b963f3806fcaa9f1d4903d71129a3c31356b9ac85f
                                                                                                                                                                                                                                • Instruction ID: f2fe1abfcbf77319f598a441f9c389c484e79d857ef84a2c81c49a586cdec899
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fa3561d5b866aa53c00a42b963f3806fcaa9f1d4903d71129a3c31356b9ac85f
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F9F0B431A0EB84CFD746BB7C98591983BE0EF5A21174905F7E008CB2A3ED28DC058391
                                                                                                                                                                                                                                Function 00007FFAACCD9EB0 Relevance: .0, Instructions: 38COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 49a6e0f644482ea93f2d505ca35c258adf9098641a122e693531b6d1086d2215
                                                                                                                                                                                                                                • Instruction ID: c09615186fe7de242e6627bc989512e5bd2ad883e4dc8237e408baf7ad83ee4c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 49a6e0f644482ea93f2d505ca35c258adf9098641a122e693531b6d1086d2215
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 96F02731618D0D8F86B4EB2CD444A7273E1EFA931030946BAD05EC3668DF20FC418780
                                                                                                                                                                                                                                Function 00007FFAAD631C30 Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1572190801.00007FFAAD630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD630000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaad630000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 183e8f1c94f90bcf3a931d3fba73611fbee46079f61aeacb969394388d636d65
                                                                                                                                                                                                                                • Instruction ID: ed1f813d84b2065c9c1977fbd3d4aeed9b2a20dc736e6bcb2708ce6e9fa08a95
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 183e8f1c94f90bcf3a931d3fba73611fbee46079f61aeacb969394388d636d65
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2EF0CD31A04A5D8FDFA5DB4CD885BE9B7B1FB68340F0085E6904DE3111DA70AAD58F80
                                                                                                                                                                                                                                Function 00007FFAACCDA08D Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 002854efd01869ed8d08ff2c7b0665d86b6c9021fac2dbc7068063cd4c90fc28
                                                                                                                                                                                                                                • Instruction ID: 6f49ecd7b16fb18de0082e711ccf9916cb4afff9fbbe2eed3eea7105fa5f9274
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 002854efd01869ed8d08ff2c7b0665d86b6c9021fac2dbc7068063cd4c90fc28
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BAF0BEB081D7C88BD70B9F284866069BFE0FF96600F0846BFE48686692DE65A5058683
                                                                                                                                                                                                                                Function 00007FFAACCD04A0 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 3a3b1a7559646a904b6306295511c3e83cdb95bdebbe5ef8a678220678d4d7a8
                                                                                                                                                                                                                                • Instruction ID: 83248d53c1bf5c07db3e52be265f0dc818a640538fe941b48ecdb12c53530bd0
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3a3b1a7559646a904b6306295511c3e83cdb95bdebbe5ef8a678220678d4d7a8
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 97F02710F0E8895FF39AA738042AABE29C1CF4711170040BFD44EC72D1EC5DAC4603C5
                                                                                                                                                                                                                                Function 00007FFAACCD1CCB Relevance: .0, Instructions: 33COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: cce7ebeaebaceb8fb025c50cf89f51f0818b5497568a1923999ab0d2ea8d7872
                                                                                                                                                                                                                                • Instruction ID: 24db7151af5fab13f178d72031cfaf1000d981cdf8b16739cf37e56b9de6aa04
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: cce7ebeaebaceb8fb025c50cf89f51f0818b5497568a1923999ab0d2ea8d7872
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 53F0375071954D5FE346FB7C48A977D77D29F4A124744057E944DC7292DE18A8198300
                                                                                                                                                                                                                                Function 00007FFAACCDA180 Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 98e2cf268e1bcfd82be890c4bffe2d65237c8b75a955148983ebeeb2aa2f8f18
                                                                                                                                                                                                                                • Instruction ID: 2977d6c0ce840ce09ca2bfdc47ba6e36bf9b01707f7c945b06d9df53401bb979
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 98e2cf268e1bcfd82be890c4bffe2d65237c8b75a955148983ebeeb2aa2f8f18
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 69E04F30B199088FDB58BB7CA8096A832D1DF8A31275405F6E40DC72A6ED69DC414380
                                                                                                                                                                                                                                Function 00007FFAACCD0CED Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: b440f6e219173ffe5e204826768edd247038cf4f0919f1dc9a60e1d1991a07c1
                                                                                                                                                                                                                                • Instruction ID: d56323ae4d294a6f71c28bac4a1a9423f42a406b6f89f079014506e88cb1e065
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b440f6e219173ffe5e204826768edd247038cf4f0919f1dc9a60e1d1991a07c1
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6DE0A752D8EA554BF6BB6A7C24565B82B91DF95210B0801FBD00DC64D7EC0DA9460396
                                                                                                                                                                                                                                Function 00007FFAAD6309F3 Relevance: .0, Instructions: 29COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1572190801.00007FFAAD630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAD630000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaad630000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 34c174a9397a2b9b2324608cfaa3142f408280eaa27e31b4cd2a27faecacc995
                                                                                                                                                                                                                                • Instruction ID: 5736caf0e59eadab6f13468dbb3f0c417101119dc4e9c0bf70dbbfa4460732c0
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 34c174a9397a2b9b2324608cfaa3142f408280eaa27e31b4cd2a27faecacc995
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EFF01232E1566D8EDB65DB48DC40BD973B1FB95350F0042E6C54DA7141DA306A898F81
                                                                                                                                                                                                                                Function 00007FFAACCE187C Relevance: .0, Instructions: 26COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 73c6f7c94a78304ff3aa0491e5d5c6941f82f86b44d573a0de2426d2115edfc6
                                                                                                                                                                                                                                • Instruction ID: a55ad0f2defb7d2475e23bb9442b5ce0c871e72c7740ca48b9c746cc2d959200
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 73c6f7c94a78304ff3aa0491e5d5c6941f82f86b44d573a0de2426d2115edfc6
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F2E0126248F2C14FEB17ABB648A10D17FA18E032203AC45EAC0C94F2A3D45E946F8342
                                                                                                                                                                                                                                Function 00007FFAACCD0D3D Relevance: .0, Instructions: 23COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 620d272183fc9338ff8ce230b66bfbf3b7d60303525a1e0ed38d1b3213e728d2
                                                                                                                                                                                                                                • Instruction ID: 848d07f6053d310e6594c3efc95568c0b4f7bbde7a4fe17da6b03cfa66e239ee
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 620d272183fc9338ff8ce230b66bfbf3b7d60303525a1e0ed38d1b3213e728d2
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B6E0485291EB959FE7B7A71C08652687EE1DB56100B4540EFC14DCB592E5459C1C43C2
                                                                                                                                                                                                                                Function 00007FFAACCD2AC2 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 9c17953070ca7b776b1f56231e8be4d708f897b6e5703caa2f5fbeb92f94e74a
                                                                                                                                                                                                                                • Instruction ID: 1e0f6c3ac0285e350d059995130391be5671305a0c1aa862f48fcb4af4258517
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9c17953070ca7b776b1f56231e8be4d708f897b6e5703caa2f5fbeb92f94e74a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DCE0EC31A1990EDEAB96EF8894466FCB7A1EB89221F504073D50EE3181D928A8558791
                                                                                                                                                                                                                                Function 00007FFAACCD1298 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: b82e26d7808620cead5658d0c785805d3e1e1861e0995cadd62b7574d3f636a6
                                                                                                                                                                                                                                • Instruction ID: 1f5db8e3291d567efb7f0f27a860eb0d789a4ac4a8c31f3fda33db50954730ad
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b82e26d7808620cead5658d0c785805d3e1e1861e0995cadd62b7574d3f636a6
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 92D05B74924B044797085F3C4C4B039B7D1F794505F94963FA84961770CEA9A4014483
                                                                                                                                                                                                                                Function 00007FFAACCDB168 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: e06cfe4847e7a9119b07458fd1c1a55581cfb7015328b793009a97f43ab74b0f
                                                                                                                                                                                                                                • Instruction ID: ccf0b30c003043f36b0b8d73647cedd6640a5488eedc5d03b426ee918b82e1ad
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e06cfe4847e7a9119b07458fd1c1a55581cfb7015328b793009a97f43ab74b0f
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 05D05B3041B1854BD7566F3104551A57BE09F07210BD814EDD48C5B253C56ED06E5341
                                                                                                                                                                                                                                Function 00007FFAACCD08B1 Relevance: .0, Instructions: 7COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: e340d270424dcc3e2fb507d8aa2fa66b78ac15794c7a2fa1e168cb1f0560653e
                                                                                                                                                                                                                                • Instruction ID: de272917942551dd4968d82d5075bd0fdb282a36ecb5f7f12ca4c8773521c5b8
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e340d270424dcc3e2fb507d8aa2fa66b78ac15794c7a2fa1e168cb1f0560653e
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9BB012C015B1C82FC1068B6408714612F910D9B0143490ACC50C187561C808440B5204

                                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                                Function 00007FFAACCD335E Relevance: .7, Instructions: 653COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: e09b63b72480b0e5658a4e771a9ee09d2a36bac176866040d8ec458738482d45
                                                                                                                                                                                                                                • Instruction ID: 611a7f5a7ba65b105a0cf373f56183254c6c5ab93a370ca28cc5fd56f952f8a8
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e09b63b72480b0e5658a4e771a9ee09d2a36bac176866040d8ec458738482d45
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E90208D760D5A64EE202B7BCF84A9F97F90DF4233570893F7D18D8A0838F58644A86D9
                                                                                                                                                                                                                                Function 00007FFAACCD3418 Relevance: .5, Instructions: 538COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 88cabd3921467a61d8b7dca838287db4ec33a34be3c30f2f5e10f8dc6ba7fbed
                                                                                                                                                                                                                                • Instruction ID: 685f146de65664959e4fc00c3d4ff7a226a138e02fac70353ad8f3de89a6e209
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 88cabd3921467a61d8b7dca838287db4ec33a34be3c30f2f5e10f8dc6ba7fbed
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 25E1D8D7A0D5A649E60277BCF45A9F97F90DF42335B0893F7D18C8E0838F58608A86D9
                                                                                                                                                                                                                                Function 00007FFAACCD34D3 Relevance: .5, Instructions: 456COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000000.00000002.1549951828.00007FFAACCD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACCD0000, based on PE: false
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_7ffaaccd0000_LisectAVT_2403002C_44.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: b9512f77f17254801378dfd91c012834bc1640b01110a5c2b6039489c88d4d32
                                                                                                                                                                                                                                • Instruction ID: eec0da0cba63df2c9e395b398f856c2dd693c7e43030d7f5b43e279a1382e8e3
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b9512f77f17254801378dfd91c012834bc1640b01110a5c2b6039489c88d4d32
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C3C11AD3A0D5664AE60277BCF45A9F97F90DF41335B0893B7E18D8E0838F58604A86DD

                                                                                                                                                                                                                                Execution Graph

                                                                                                                                                                                                                                Execution Coverage:2.2%
                                                                                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                Signature Coverage:19.7%
                                                                                                                                                                                                                                Total number of Nodes:1352
                                                                                                                                                                                                                                Total number of Limit Nodes:54
                                                                                                                                                                                                                                execution_graph 46439 404e20 RtlEnterCriticalSection 46440 42f640 46441 42f648 46440->46441 46442 42f64d 46440->46442 46444 42f570 46441->46444 46448 42f5b3 46444->46448 46451 42f5f5 46444->46451 46445 42f619 ~_Mpunct 46445->46442 46446 42f60b InterlockedDecrement 46446->46445 46449 42f5e9 Sleep 46448->46449 46448->46451 46453 42f660 79 API calls _DebugHeapAllocator 46448->46453 46454 40dce0 76 API calls 2 library calls 46448->46454 46455 42f3b0 85 API calls 3 library calls 46448->46455 46449->46448 46451->46445 46451->46446 46453->46448 46454->46448 46455->46448 46456 42c440 46459 42c460 MoveFileExW 46456->46459 46458 42c448 ctype 46473 411010 46459->46473 46462 42c4e6 ~_Mpunct 46464 411010 76 API calls 46462->46464 46463 42c4dc InterlockedDecrement 46463->46462 46465 42c506 MoveFileExW 46464->46465 46466 42c538 MoveFileExW 46465->46466 46467 42c51e InterlockedDecrement 46465->46467 46469 42c559 ~_Mpunct 46466->46469 46470 42c54f InterlockedDecrement 46466->46470 46467->46466 46468 42c528 ~_Mpunct 46467->46468 46468->46466 46471 42c575 InterlockedDecrement 46469->46471 46472 42c57f ~_Mpunct 46469->46472 46470->46469 46471->46472 46472->46458 46474 411057 lstrlenW 46473->46474 46475 41105e 46473->46475 46474->46475 46478 4101b0 46475->46478 46477 411070 MoveFileExW 46477->46462 46477->46463 46479 4101c1 46478->46479 46481 4101d5 __setlocale_set_cat 46478->46481 46479->46481 46482 40e4a0 75 API calls numpunct 46479->46482 46481->46477 46482->46481 46483 453a87 46520 453dcc 46483->46520 46485 453a93 GetStartupInfoW 46487 453ab6 46485->46487 46521 45715d HeapCreate 46487->46521 46489 453b06 46523 456f2d GetModuleHandleW 46489->46523 46493 453b17 __RTC_Initialize 46557 460b9a 46493->46557 46496 453b25 46497 453b31 GetCommandLineW 46496->46497 46896 452ac6 67 API calls 3 library calls 46496->46896 46572 460b3d GetEnvironmentStringsW 46497->46572 46500 453b40 46579 460a8f GetModuleFileNameW 46500->46579 46501 453b30 46501->46497 46506 453b55 46585 460860 46506->46585 46508 453b66 46598 452b85 46508->46598 46511 453b6d 46513 453b78 __wwincmdln 46511->46513 46899 452ac6 67 API calls 3 library calls 46511->46899 46604 4036f0 46513->46604 46515 453b99 46516 453ba7 46515->46516 46891 452d36 46515->46891 46900 452d62 67 API calls _doexit 46516->46900 46519 453bac __read 46520->46485 46522 453afa 46521->46522 46522->46489 46894 453a5e 67 API calls 3 library calls 46522->46894 46524 456f41 46523->46524 46525 456f48 46523->46525 46901 452a96 Sleep GetModuleHandleW 46524->46901 46526 4570b0 46525->46526 46527 456f52 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 46525->46527 46949 456bd9 70 API calls 2 library calls 46526->46949 46529 456f9b TlsAlloc 46527->46529 46533 453b0c 46529->46533 46534 456fe9 TlsSetValue 46529->46534 46531 456f47 46531->46525 46533->46493 46895 453a5e 67 API calls 3 library calls 46533->46895 46534->46533 46535 456ffa 46534->46535 46902 452d80 6 API calls 4 library calls 46535->46902 46537 456fff 46903 456a72 TlsGetValue 46537->46903 46540 456a72 __encode_pointer 6 API calls 46541 45701a 46540->46541 46542 456a72 __encode_pointer 6 API calls 46541->46542 46543 45702a 46542->46543 46544 456a72 __encode_pointer 6 API calls 46543->46544 46545 45703a 46544->46545 46913 45718d InitializeCriticalSectionAndSpinCount ___lock_fhandle 46545->46913 46547 457047 46547->46526 46914 456aed TlsGetValue 46547->46914 46552 456aed __decode_pointer 6 API calls 46553 45708e 46552->46553 46553->46526 46554 457095 46553->46554 46930 456c16 46554->46930 46556 45709d GetCurrentThreadId 46556->46533 47001 453dcc 46557->47001 46559 460ba6 GetStartupInfoA 46560 45517a __calloc_crt 67 API calls 46559->46560 46568 460bc7 46560->46568 46561 460de5 __read 46561->46496 46562 460d62 GetStdHandle 46567 460d2c 46562->46567 46563 45517a __calloc_crt 67 API calls 46563->46568 46564 460dc7 SetHandleCount 46564->46561 46565 460d74 GetFileType 46565->46567 46566 460caf 46566->46561 46566->46567 46569 460cd8 GetFileType 46566->46569 47002 45f0e8 InitializeCriticalSectionAndSpinCount __read 46566->47002 46567->46561 46567->46562 46567->46564 46567->46565 47003 45f0e8 InitializeCriticalSectionAndSpinCount __read 46567->47003 46568->46561 46568->46563 46568->46566 46568->46567 46569->46566 46573 460b52 46572->46573 46574 460b4e 46572->46574 47004 455135 67 API calls _malloc 46573->47004 46574->46500 46577 460b73 __setlocale_set_cat 46578 460b7a FreeEnvironmentStringsW 46577->46578 46578->46500 46580 460ac4 _wparse_cmdline 46579->46580 46581 453b4a 46580->46581 46582 460b01 46580->46582 46581->46506 46897 452ac6 67 API calls 3 library calls 46581->46897 47005 455135 67 API calls _malloc 46582->47005 46584 460b07 _wparse_cmdline 46584->46581 46586 460878 _wcslen 46585->46586 46590 453b5b 46585->46590 46587 45517a __calloc_crt 67 API calls 46586->46587 46592 46089c _wcslen 46587->46592 46588 460901 47008 44fd07 46588->47008 46590->46508 46898 452ac6 67 API calls 3 library calls 46590->46898 46591 45517a __calloc_crt 67 API calls 46591->46592 46592->46588 46592->46590 46592->46591 46593 460927 46592->46593 46597 4608e6 46592->46597 47006 466d0a 67 API calls __vswprintf_s_l 46592->47006 46594 44fd07 ___init_time 67 API calls 46593->46594 46594->46590 46597->46592 47007 4500e9 10 API calls 3 library calls 46597->47007 46600 452b93 __IsNonwritableInCurrentImage 46598->46600 47024 45ee97 46600->47024 46601 452bb1 __initterm_e 46603 452bd0 __IsNonwritableInCurrentImage __initterm 46601->46603 47028 44fcf0 46601->47028 46603->46511 47072 4035d0 46604->47072 46608 40373b 46609 403813 46608->46609 46613 40376e 46608->46613 47092 4096b0 46609->47092 47209 406440 81 API calls 3 library calls 46613->47209 46616 403957 ~_Mpunct 47117 405e60 46616->47117 46617 40377d 47210 4063e0 87 API calls 46617->47210 46621 403786 47211 406370 87 API calls __fptostr 46621->47211 46622 403858 46625 40387b 46622->46625 47222 40e5f0 78 API calls 46622->47222 47224 403520 86 API calls 2 library calls 46625->47224 46628 40378f GetModuleFileNameW 47212 4062a0 178 API calls 46628->47212 46630 403978 46634 403980 46630->46634 46650 403a5f 46630->46650 46631 403898 46635 4038b7 ~_Mpunct 46631->46635 46636 4038a9 InterlockedDecrement 46631->46636 46633 403876 47223 42da60 79 API calls ~_Mpunct 46633->47223 46639 403a03 ~_Mpunct 46634->46639 47228 4050c0 97 API calls ~_Mpunct 46634->47228 46642 4038fe 46635->46642 47225 403520 86 API calls 2 library calls 46635->47225 46636->46635 46637 4037b6 46643 4037e3 InterlockedDecrement 46637->46643 46644 4037f1 ~_Mpunct 46637->46644 47230 40a8d0 79 API calls ctype 46639->47230 46649 40391d 46642->46649 47226 409f60 InterlockedDecrement ~_Mpunct 46642->47226 46643->46644 47213 44fbba 46644->47213 46646 403a1d 46652 403a3a ~_Mpunct 46646->46652 46653 403a2c InterlockedDecrement 46646->46653 46647 40399b 47229 4050c0 97 API calls ~_Mpunct 46647->47229 47227 403520 86 API calls 2 library calls 46649->47227 47151 402f70 46650->47151 46651 40380d 46651->46515 46658 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 46652->46658 46653->46652 46657 4039ab 46666 4039d6 ~_Mpunct 46657->46666 46667 4039c8 InterlockedDecrement 46657->46667 46659 403a59 46658->46659 46659->46515 46660 403a98 47156 451c82 46660->47156 46663 40393e 46663->46616 46665 403949 InterlockedDecrement 46663->46665 46664 403aa7 47192 405000 76 API calls std::_Mutex::_Mutex 46664->47192 46665->46616 46666->46639 46668 4039f5 InterlockedDecrement 46666->46668 46667->46666 46668->46639 46670 403aaf 47193 402e50 GetModuleFileNameW 46670->47193 46674 403ab9 47199 42f540 46674->47199 46678 403ad2 46679 403b39 46678->46679 46680 403ad6 IsWindow 46678->46680 47232 401000 74 API calls __cinit 46679->47232 46681 403ae5 46680->46681 46689 403af0 46680->46689 46681->46689 46684 403b47 47233 42fa50 80 API calls 46684->47233 46686 403b4e 47234 4272f0 35 API calls 46686->47234 46688 403b5a 47235 414340 67 API calls 46688->47235 47231 40a8d0 79 API calls ctype 46689->47231 46691 403b68 46692 403bb0 46691->46692 46707 403bcc _memset 46691->46707 47236 4050c0 97 API calls ~_Mpunct 46691->47236 47241 40a8d0 79 API calls ctype 46692->47241 46694 403bee GetTempPathW 46704 403c12 46694->46704 46695 403b82 47237 4050c0 97 API calls ~_Mpunct 46695->47237 46698 403bc3 47242 409f60 InterlockedDecrement ~_Mpunct 46698->47242 46699 403b92 47238 418c40 136 API calls ~_Mpunct 46699->47238 46700 403ccd 47254 40ae70 75 API calls 46700->47254 46704->46700 46705 403f59 46704->46705 47243 4050c0 97 API calls ~_Mpunct 46704->47243 47368 40a8d0 79 API calls ctype 46705->47368 46707->46694 46708 403ce4 47255 409950 FindResourceW 46708->47255 46709 403b9d 47239 409f60 InterlockedDecrement ~_Mpunct 46709->47239 46710 403c34 47244 4050c0 97 API calls ~_Mpunct 46710->47244 46716 403ba7 47240 409f60 InterlockedDecrement ~_Mpunct 46716->47240 46718 403c44 47245 418c40 136 API calls ~_Mpunct 46718->47245 46719 403f71 47369 409f60 InterlockedDecrement ~_Mpunct 46719->47369 46723 403cfc 47280 4026f0 91 API calls 2 library calls 46723->47280 46725 403c51 47246 409f60 InterlockedDecrement ~_Mpunct 46725->47246 46726 403d05 47281 40d760 82 API calls __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 46726->47281 46729 403c5f 47247 409f60 InterlockedDecrement ~_Mpunct 46729->47247 46730 403d15 46733 403d22 46730->46733 47282 4026f0 91 API calls 2 library calls 46730->47282 46732 403f7a 47370 42c5b0 227 API calls ~_Mpunct 46732->47370 47283 40d760 82 API calls __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 46733->47283 46734 403c68 46738 403ef8 46734->46738 47248 404d40 87 API calls 2 library calls 46734->47248 47361 4050c0 97 API calls ~_Mpunct 46738->47361 46739 403f8c 46743 40410b 46739->46743 46760 403fa1 46739->46760 46741 403d32 46745 403d3f 46741->46745 47284 4026f0 91 API calls 2 library calls 46741->47284 46751 404130 46743->46751 47395 4050c0 97 API calls ~_Mpunct 46743->47395 46744 403f0f 47362 4050c0 97 API calls ~_Mpunct 46744->47362 47285 40d760 82 API calls __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 46745->47285 46746 403c84 46749 403cbb 46746->46749 47249 4050c0 97 API calls ~_Mpunct 46746->47249 47253 409f60 InterlockedDecrement ~_Mpunct 46749->47253 47398 409e00 81 API calls ctype 46751->47398 46755 403f1f 47363 418c40 136 API calls ~_Mpunct 46755->47363 46757 403d4f 46758 403d5c 46757->46758 47286 4026f0 91 API calls 2 library calls 46757->47286 47287 40d760 82 API calls __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 46758->47287 46759 404122 47396 418a80 135 API calls ~_Mpunct 46759->47396 47371 427dc0 96 API calls 46760->47371 46761 40413a 47399 409f60 InterlockedDecrement ~_Mpunct 46761->47399 46763 403c96 47250 4050c0 97 API calls ~_Mpunct 46763->47250 46770 403f2a 47364 409f60 InterlockedDecrement ~_Mpunct 46770->47364 46771 403ca6 47251 418c40 136 API calls ~_Mpunct 46771->47251 46772 404129 47397 409f60 InterlockedDecrement ~_Mpunct 46772->47397 46773 403d6c 47288 406bb0 46773->47288 46774 403fab 46780 403fc4 46774->46780 47372 404f50 83 API calls __cinit 46774->47372 46775 404143 47400 409f60 InterlockedDecrement ~_Mpunct 46775->47400 47374 42d660 119 API calls 3 library calls 46780->47374 46782 403f34 47365 409f60 InterlockedDecrement ~_Mpunct 46782->47365 46783 403cb1 47252 409f60 InterlockedDecrement ~_Mpunct 46783->47252 46784 403d84 47333 40e2a0 46784->47333 46788 403fc9 47375 42d360 204 API calls 2 library calls 46788->47375 46791 403fba 47373 42f390 78 API calls 46791->47373 46792 403f3d 47366 40a8d0 79 API calls ctype 46792->47366 46794 403d8f 47343 409f60 InterlockedDecrement ~_Mpunct 46794->47343 46798 403d98 46802 403da5 46798->46802 47344 4026f0 91 API calls 2 library calls 46798->47344 46800 40415f 47402 409f60 InterlockedDecrement ~_Mpunct 46800->47402 46801 403f50 47367 409f60 InterlockedDecrement ~_Mpunct 46801->47367 47345 40d760 82 API calls __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 46802->47345 46807 403db5 46810 406bb0 111 API calls 46807->46810 46808 404168 46811 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 46808->46811 46809 403fce 46818 404059 46809->46818 47376 41c270 132 API calls ~_Mpunct 46809->47376 46813 403dcd 46810->46813 46814 40417c 46811->46814 46816 40e2a0 78 API calls 46813->46816 46814->46515 46815 40401c 46817 404021 46815->46817 46815->46818 46820 403dd8 46816->46820 47377 427e70 InterlockedDecrement InterlockedDecrement InterlockedDecrement ~_Mpunct 46817->47377 47381 414e70 246 API calls 4 library calls 46818->47381 47346 409f60 InterlockedDecrement ~_Mpunct 46820->47346 46822 40402a 47378 409e00 81 API calls ctype 46822->47378 46824 404063 46827 404074 46824->46827 47382 402370 252 API calls 6 library calls 46824->47382 46826 403de1 46830 403dee 46826->46830 47347 4026f0 91 API calls 2 library calls 46826->47347 47383 402fd0 393 API calls 2 library calls 46827->47383 46829 404034 47379 409f60 InterlockedDecrement ~_Mpunct 46829->47379 47348 40d760 82 API calls __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 46830->47348 46832 40407d 47384 42ab60 78 API calls 2 library calls 46832->47384 46837 40403d 47380 409f60 InterlockedDecrement ~_Mpunct 46837->47380 46838 403dfe 46841 406bb0 111 API calls 46838->46841 46839 40408c Sleep 47385 402ea0 88 API calls 2 library calls 46839->47385 46844 403e16 46841->46844 46843 404046 47401 40a8d0 79 API calls ctype 46843->47401 46845 40e2a0 78 API calls 46844->46845 46847 403e21 46845->46847 46846 40409c 47386 404810 71 API calls 2 library calls 46846->47386 47349 409f60 InterlockedDecrement ~_Mpunct 46847->47349 46850 4040a1 47387 404f50 83 API calls __cinit 46850->47387 46851 403e2a 46852 403e37 46851->46852 47350 4026f0 91 API calls 2 library calls 46851->47350 46852->46732 46854 403e8b 46852->46854 47351 4050c0 97 API calls ~_Mpunct 46852->47351 46858 403eb2 46854->46858 47355 409f60 InterlockedDecrement ~_Mpunct 46854->47355 46857 4040ac 47388 42f520 WaitForSingleObject 46857->47388 46862 403ec3 46858->46862 47356 409f60 InterlockedDecrement ~_Mpunct 46858->47356 46859 403e61 47352 4050c0 97 API calls ~_Mpunct 46859->47352 46866 403ed1 46862->46866 47357 409f60 InterlockedDecrement ~_Mpunct 46862->47357 46864 4040b1 47389 427e70 InterlockedDecrement InterlockedDecrement InterlockedDecrement ~_Mpunct 46864->47389 46870 403ee2 46866->46870 47358 449660 219 API calls 2 library calls 46866->47358 46867 403e71 47353 4050c0 97 API calls ~_Mpunct 46867->47353 47359 409e00 81 API calls ctype 46870->47359 46872 4040ba 47390 409e00 81 API calls ctype 46872->47390 46876 403e81 47354 418e10 120 API calls ~_Mpunct 46876->47354 46877 403eef 47360 409f60 InterlockedDecrement ~_Mpunct 46877->47360 46878 4040c4 47391 409f60 InterlockedDecrement ~_Mpunct 46878->47391 46882 4040cd 47392 409f60 InterlockedDecrement ~_Mpunct 46882->47392 46884 4040d6 47393 40a8d0 79 API calls ctype 46884->47393 46886 4040e9 47394 409f60 InterlockedDecrement ~_Mpunct 46886->47394 46888 4040f2 46889 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 46888->46889 46890 404105 46889->46890 46890->46515 47971 452c0a 46891->47971 46893 452d47 46893->46516 46894->46489 46895->46493 46896->46501 46897->46506 46898->46508 46899->46513 46900->46519 46901->46531 46902->46537 46904 456aab GetModuleHandleW 46903->46904 46905 456a8a 46903->46905 46907 456ac6 GetProcAddress 46904->46907 46908 456abb 46904->46908 46905->46904 46906 456a94 TlsGetValue 46905->46906 46910 456a9f 46906->46910 46912 456aa3 46907->46912 46950 452a96 Sleep GetModuleHandleW 46908->46950 46910->46904 46910->46912 46911 456ac1 46911->46907 46911->46912 46912->46540 46913->46547 46915 456b05 46914->46915 46916 456b26 GetModuleHandleW 46914->46916 46915->46916 46917 456b0f TlsGetValue 46915->46917 46918 456b36 46916->46918 46919 456b41 GetProcAddress 46916->46919 46923 456b1a 46917->46923 46951 452a96 Sleep GetModuleHandleW 46918->46951 46922 456b1e 46919->46922 46921 456b3c 46921->46919 46921->46922 46922->46526 46924 45517a 46922->46924 46923->46916 46923->46922 46925 455183 46924->46925 46927 4551c0 46925->46927 46928 4551a1 Sleep 46925->46928 46952 462da9 46925->46952 46927->46526 46927->46552 46929 4551b6 46928->46929 46929->46925 46929->46927 46979 453dcc 46930->46979 46932 456c22 GetModuleHandleW 46933 456c32 46932->46933 46934 456c39 46932->46934 46980 452a96 Sleep GetModuleHandleW 46933->46980 46936 456c74 46934->46936 46937 456c50 GetProcAddress GetProcAddress 46934->46937 46939 457309 __lock 63 API calls 46936->46939 46937->46936 46938 456c38 46938->46934 46940 456c93 InterlockedIncrement 46939->46940 46981 456ceb 46940->46981 46943 457309 __lock 63 API calls 46944 456cb4 46943->46944 46984 450eca InterlockedIncrement 46944->46984 46946 456cd2 46996 456cf4 46946->46996 46948 456cdf __read 46948->46556 46949->46533 46950->46911 46951->46921 46953 462db5 __read 46952->46953 46954 462dcd 46953->46954 46964 462dec _memset 46953->46964 46965 4552a8 67 API calls __getptd_noexit 46954->46965 46956 462dd2 46966 450211 6 API calls 2 library calls 46956->46966 46957 462de2 __read 46957->46925 46959 462e5e HeapAlloc 46959->46964 46964->46957 46964->46959 46967 457309 46964->46967 46974 457b1b 5 API calls 2 library calls 46964->46974 46975 462ea5 LeaveCriticalSection _doexit 46964->46975 46976 457e0f 6 API calls __decode_pointer 46964->46976 46965->46956 46968 457331 EnterCriticalSection 46967->46968 46969 45731e 46967->46969 46968->46964 46977 457246 67 API calls 10 library calls 46969->46977 46971 457324 46971->46968 46978 452ac6 67 API calls 3 library calls 46971->46978 46973 457330 46973->46968 46974->46964 46975->46964 46976->46964 46977->46971 46978->46973 46979->46932 46980->46938 46999 45722f LeaveCriticalSection 46981->46999 46983 456cad 46983->46943 46985 450ee8 InterlockedIncrement 46984->46985 46986 450eeb 46984->46986 46985->46986 46987 450ef5 InterlockedIncrement 46986->46987 46988 450ef8 46986->46988 46987->46988 46989 450f05 46988->46989 46990 450f02 InterlockedIncrement 46988->46990 46991 450f0f InterlockedIncrement 46989->46991 46992 450f12 46989->46992 46990->46989 46991->46992 46993 450f2b InterlockedIncrement 46992->46993 46994 450f3b InterlockedIncrement 46992->46994 46995 450f46 InterlockedIncrement 46992->46995 46993->46992 46994->46992 46995->46946 47000 45722f LeaveCriticalSection 46996->47000 46998 456cfb 46998->46948 46999->46983 47000->46998 47001->46559 47002->46566 47003->46567 47004->46577 47005->46584 47006->46592 47007->46597 47010 44fd13 __read 47008->47010 47009 44fd52 47011 44fd8c _realloc __read 47009->47011 47012 44fd67 RtlFreeHeap 47009->47012 47010->47009 47010->47011 47013 457309 __lock 65 API calls 47010->47013 47011->46590 47012->47011 47014 44fd79 47012->47014 47018 44fd2a ___sbh_find_block 47013->47018 47023 4552a8 67 API calls __getptd_noexit 47014->47023 47016 44fd7e GetLastError 47016->47011 47017 44fd44 47022 44fd5d LeaveCriticalSection _doexit 47017->47022 47018->47017 47021 45736c __VEC_memcpy VirtualFree VirtualFree HeapFree __fptostr 47018->47021 47021->47017 47022->47009 47023->47016 47026 45ee9d 47024->47026 47025 456a72 __encode_pointer 6 API calls 47025->47026 47026->47025 47027 45eeb5 47026->47027 47027->46601 47031 44fcb4 47028->47031 47030 44fcfd 47030->46603 47032 44fcc0 __read 47031->47032 47039 452b32 47032->47039 47038 44fce1 __read 47038->47030 47040 457309 __lock 67 API calls 47039->47040 47041 44fcc5 47040->47041 47042 44fbc9 47041->47042 47043 456aed __decode_pointer 6 API calls 47042->47043 47044 44fbdd 47043->47044 47045 456aed __decode_pointer 6 API calls 47044->47045 47046 44fbed 47045->47046 47057 44fc70 47046->47057 47065 4570ba 68 API calls 5 library calls 47046->47065 47048 456a72 __encode_pointer 6 API calls 47052 44fc65 47048->47052 47049 44fc0b 47050 44fc35 47049->47050 47051 44fc26 47049->47051 47061 44fc57 47049->47061 47054 44fc2f 47050->47054 47050->47057 47066 4551c6 73 API calls _realloc 47051->47066 47055 456a72 __encode_pointer 6 API calls 47052->47055 47054->47050 47058 44fc4b 47054->47058 47067 4551c6 73 API calls _realloc 47054->47067 47055->47057 47062 44fcea 47057->47062 47060 456a72 __encode_pointer 6 API calls 47058->47060 47059 44fc45 47059->47057 47059->47058 47060->47061 47061->47048 47068 452b3b 47062->47068 47065->47049 47066->47054 47067->47059 47071 45722f LeaveCriticalSection 47068->47071 47070 44fcef 47070->47038 47071->47070 47403 44d280 47072->47403 47074 403608 _memset 47075 40362e GetSystemDirectoryW 47074->47075 47076 403655 47075->47076 47077 40366a PathAppendW 47076->47077 47078 4036c1 ~_Mpunct 47076->47078 47079 403699 LoadLibraryExW 47077->47079 47080 40367d GetModuleHandleW GetProcAddress 47077->47080 47081 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 47078->47081 47079->47076 47080->47079 47082 4036dc CoInitialize 47081->47082 47083 40d850 47082->47083 47084 40d85b 47083->47084 47088 40d888 __setlocale_set_cat 47083->47088 47085 40d871 lstrlenW 47084->47085 47086 40d864 47084->47086 47085->47088 47089 40d87f 47085->47089 47451 40d760 82 API calls __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 47086->47451 47088->46608 47452 40e4a0 75 API calls numpunct 47089->47452 47090 40d86e 47090->46608 47453 44fe2d 47092->47453 47097 4032b0 47098 4032f0 CommandLineToArgvW 47097->47098 47099 4032df GetCommandLineW 47097->47099 47100 4032e9 47098->47100 47102 40330c ~_Mpunct _wcschr 47098->47102 47099->47098 47099->47100 47100->46616 47221 403520 86 API calls 2 library calls 47100->47221 47101 4034f5 LocalFree 47101->47100 47102->47101 47103 40d850 83 API calls 47102->47103 47104 40e2a0 78 API calls 47102->47104 47110 4033b7 InterlockedDecrement 47102->47110 47113 403488 InterlockedDecrement 47102->47113 47114 4034a6 InterlockedDecrement 47102->47114 47115 403409 InterlockedDecrement 47102->47115 47116 4034cb InterlockedDecrement 47102->47116 47481 40e280 75 API calls 47102->47481 47482 40e400 75 API calls __setlocale_set_cat 47102->47482 47483 406750 76 API calls __fptostr 47102->47483 47484 4066f0 76 API calls 47102->47484 47485 40e320 76 API calls 2 library calls 47102->47485 47103->47102 47104->47102 47109 403453 CharLowerW 47486 4088c0 87 API calls 2 library calls 47109->47486 47110->47102 47113->47102 47114->47102 47115->47102 47116->47102 47118 409950 125 API calls 47117->47118 47119 405e90 47118->47119 47120 406bb0 111 API calls 47119->47120 47121 405ea6 47120->47121 47122 40e2a0 78 API calls 47121->47122 47123 405eba 47122->47123 47124 405ee0 ~_Mpunct 47123->47124 47125 405ed6 InterlockedDecrement 47123->47125 47126 406bb0 111 API calls 47124->47126 47125->47124 47127 405f06 47126->47127 47128 40e2a0 78 API calls 47127->47128 47129 405f1a 47128->47129 47130 405f47 lstrlenW 47129->47130 47131 405f2d InterlockedDecrement 47129->47131 47487 40e540 47130->47487 47131->47130 47133 405f37 ~_Mpunct 47131->47133 47133->47130 47134 405f63 47493 4058a0 47134->47493 47138 405f82 47139 403973 47138->47139 47140 40e2a0 78 API calls 47138->47140 47141 403230 47139->47141 47140->47139 47682 453d50 47141->47682 47143 403255 GetVersionExW 47144 403271 47143->47144 47145 403292 47143->47145 47144->47145 47146 403278 47144->47146 47147 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 47145->47147 47148 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 47146->47148 47149 4032a2 47147->47149 47150 40328b 47148->47150 47149->46630 47150->46630 47152 453d50 _memset 47151->47152 47153 402f89 GetClassInfoExW 47152->47153 47154 402fa0 47153->47154 47155 402fa4 RegisterClassExW 47153->47155 47154->46660 47155->46660 47157 451c8e __read 47156->47157 47158 451c99 47157->47158 47159 451cb8 47157->47159 47729 4552a8 67 API calls __getptd_noexit 47158->47729 47684 456d76 47159->47684 47162 451c9e 47730 450211 6 API calls 2 library calls 47162->47730 47166 451cc7 47167 45517a __calloc_crt 67 API calls 47166->47167 47168 451cda 47167->47168 47169 451cae __read _setlocale 47168->47169 47170 457309 __lock 67 API calls 47168->47170 47169->46664 47171 451cf0 47170->47171 47704 450ff2 47171->47704 47178 451dc7 47735 450f59 8 API calls 47178->47735 47179 451d23 __setlocale_set_cat 47181 457309 __lock 67 API calls 47179->47181 47183 451d4c 47181->47183 47182 451dcd 47736 450d81 67 API calls 4 library calls 47182->47736 47731 451018 75 API calls 3 library calls 47183->47731 47186 451d5e 47732 450f59 8 API calls 47186->47732 47188 451d64 47191 451d80 __setlocale_set_cat _sync_legacy_variables_lk 47188->47191 47733 451018 75 API calls 3 library calls 47188->47733 47734 451dbc LeaveCriticalSection _doexit 47191->47734 47192->46670 47872 402920 47193->47872 47196 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 47197 402e8c 47196->47197 47198 404f50 83 API calls __cinit 47197->47198 47198->46674 47898 45087f 47199->47898 47202 42aae0 CreateMutexW 47203 42ab54 47202->47203 47204 42aafd GetLastError 47202->47204 47203->46678 47205 42ab30 EnterCriticalSection 47204->47205 47206 42ab0a FindCloseChangeNotification FindWindowW 47204->47206 47958 42ade0 75 API calls _DebugHeapAllocator 47205->47958 47206->46678 47208 42ab49 LeaveCriticalSection 47208->47203 47209->46617 47210->46621 47211->46628 47212->46637 47214 44fbc4 IsDebuggerPresent 47213->47214 47215 44fbc2 47213->47215 47959 457f98 47214->47959 47215->46651 47218 456a39 SetUnhandledExceptionFilter UnhandledExceptionFilter 47219 456a56 __invoke_watson 47218->47219 47220 456a5e GetCurrentProcess TerminateProcess 47218->47220 47219->47220 47220->46651 47221->46622 47222->46633 47223->46625 47224->46631 47225->46642 47226->46649 47227->46663 47228->46647 47229->46657 47230->46646 47231->46679 47232->46684 47233->46686 47234->46688 47235->46691 47236->46695 47237->46699 47238->46709 47239->46716 47240->46692 47241->46698 47242->46707 47243->46710 47244->46718 47245->46725 47246->46729 47247->46734 47248->46746 47249->46763 47250->46771 47251->46783 47252->46749 47253->46700 47254->46708 47256 409dd5 47255->47256 47257 4099ce LoadResource 47255->47257 47262 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 47256->47262 47258 4099ea SizeofResource 47257->47258 47272 409d3b ~_Mpunct ctype 47257->47272 47260 409a10 47258->47260 47261 409a02 FreeResource 47258->47261 47259 409dce FreeResource 47259->47256 47263 44d280 numpunct 75 API calls 47260->47263 47261->47256 47264 403cee 47262->47264 47265 409a28 _memset 47263->47265 47279 40d760 82 API calls __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 47264->47279 47266 409a45 LockResource 47265->47266 47265->47272 47267 409a58 __setlocale_set_cat 47266->47267 47268 40f080 75 API calls 47267->47268 47269 409a74 47268->47269 47270 407770 75 API calls 47269->47270 47276 409a8b ctype 47270->47276 47272->47256 47272->47259 47273 40dc30 75 API calls 47273->47276 47274 408140 75 API calls 47274->47276 47276->47272 47276->47273 47276->47274 47960 450237 6 API calls __vswprintf_s_l 47276->47960 47961 40d980 75 API calls 2 library calls 47276->47961 47962 4080c0 96 API calls ~_Mpunct 47276->47962 47963 409870 106 API calls ~_Mpunct 47276->47963 47279->46723 47280->46726 47281->46730 47282->46733 47283->46741 47284->46745 47285->46757 47286->46758 47287->46773 47289 40d850 83 API calls 47288->47289 47290 406bec 47289->47290 47291 40d850 83 API calls 47290->47291 47292 406c0a 47291->47292 47293 406b00 6 API calls 47292->47293 47294 406c28 47293->47294 47295 406c3b 47294->47295 47964 450237 6 API calls __vswprintf_s_l 47294->47964 47297 406c50 InterlockedDecrement 47295->47297 47298 406c5e ~_Mpunct 47295->47298 47297->47298 47299 40d850 83 API calls 47298->47299 47331 406ded ~_Mpunct 47298->47331 47300 406c7d 47299->47300 47301 40d850 83 API calls 47300->47301 47302 406c92 47301->47302 47303 40d850 83 API calls 47302->47303 47304 406ca5 47303->47304 47965 409740 89 API calls 2 library calls 47304->47965 47306 406cb5 47966 409740 89 API calls 2 library calls 47306->47966 47308 406ccc 47967 4041f0 6 API calls _DebugHeapAllocator 47308->47967 47310 406cd6 47311 406ce9 47310->47311 47968 450237 6 API calls __vswprintf_s_l 47310->47968 47313 406d04 InterlockedDecrement 47311->47313 47314 406d0e ~_Mpunct 47311->47314 47313->47314 47315 406d26 InterlockedDecrement 47314->47315 47316 406d30 ~_Mpunct 47314->47316 47315->47316 47317 406d57 ~_Mpunct 47316->47317 47318 406d4d InterlockedDecrement 47316->47318 47319 40d850 83 API calls 47317->47319 47317->47331 47318->47317 47320 406d75 47319->47320 47321 40d850 83 API calls 47320->47321 47322 406d8b 47321->47322 47969 409740 89 API calls 2 library calls 47322->47969 47324 406d9e 47970 4088c0 87 API calls 2 library calls 47324->47970 47326 406da5 47327 40e2a0 78 API calls 47326->47327 47328 406db2 47327->47328 47329 406dc1 InterlockedDecrement 47328->47329 47332 406dcb ~_Mpunct 47328->47332 47329->47332 47330 406de3 InterlockedDecrement 47330->47331 47331->46784 47332->47330 47332->47331 47334 40e30e 47333->47334 47335 40e2ab 47333->47335 47334->46794 47336 40e2c6 47335->47336 47337 40e2d4 47335->47337 47338 40e540 76 API calls 47336->47338 47339 40e2de InterlockedDecrement 47337->47339 47340 40e2ff InterlockedIncrement 47337->47340 47342 40e2cf 47338->47342 47341 40e2e9 ~_Mpunct 47339->47341 47340->47334 47341->47340 47342->46794 47343->46798 47344->46802 47345->46807 47346->46826 47347->46830 47348->46838 47349->46851 47350->46852 47351->46859 47352->46867 47353->46876 47354->46854 47355->46858 47356->46862 47357->46866 47358->46870 47359->46877 47360->46738 47361->46744 47362->46755 47363->46770 47364->46782 47365->46792 47366->46801 47367->46705 47368->46719 47369->46732 47370->46739 47371->46774 47372->46791 47373->46780 47374->46788 47375->46809 47376->46815 47377->46822 47378->46829 47379->46837 47380->46843 47381->46824 47382->46827 47383->46832 47384->46839 47385->46846 47386->46850 47387->46857 47388->46864 47389->46872 47390->46878 47391->46882 47392->46884 47393->46886 47394->46888 47395->46759 47396->46772 47397->46751 47398->46761 47399->46775 47400->46843 47401->46800 47402->46808 47405 44fe2d 47403->47405 47406 44fe51 47405->47406 47410 44fe53 std::bad_alloc::bad_alloc 47405->47410 47415 450a72 47405->47415 47433 457e0f 6 API calls __decode_pointer 47405->47433 47406->47074 47408 44fe79 47434 40eb10 67 API calls std::exception::exception 47408->47434 47410->47408 47412 44fcf0 __cinit 74 API calls 47410->47412 47411 44fe83 47435 453fbc RaiseException 47411->47435 47412->47408 47414 44fe91 47416 450b25 47415->47416 47421 450a84 47415->47421 47445 457e0f 6 API calls __decode_pointer 47416->47445 47418 450b2b 47446 4552a8 67 API calls __getptd_noexit 47418->47446 47422 450b1d 47421->47422 47425 450ae1 RtlAllocateHeap 47421->47425 47426 450a95 47421->47426 47428 450b11 47421->47428 47431 450b16 47421->47431 47441 450a23 67 API calls 4 library calls 47421->47441 47442 457e0f 6 API calls __decode_pointer 47421->47442 47422->47405 47425->47421 47426->47421 47436 4592f2 67 API calls 2 library calls 47426->47436 47437 459147 67 API calls 7 library calls 47426->47437 47438 452b1a 47426->47438 47443 4552a8 67 API calls __getptd_noexit 47428->47443 47444 4552a8 67 API calls __getptd_noexit 47431->47444 47433->47405 47434->47411 47435->47414 47436->47426 47437->47426 47447 452aef GetModuleHandleW 47438->47447 47441->47421 47442->47421 47443->47431 47444->47422 47445->47418 47446->47422 47448 452b03 GetProcAddress 47447->47448 47449 452b18 ExitProcess 47447->47449 47448->47449 47450 452b13 47448->47450 47450->47449 47451->47090 47452->47088 47455 44fe37 47453->47455 47454 450a72 _malloc 67 API calls 47454->47455 47455->47454 47456 4096dc 47455->47456 47460 44fe53 std::bad_alloc::bad_alloc 47455->47460 47468 457e0f 6 API calls __decode_pointer 47455->47468 47465 409670 47456->47465 47458 44fe79 47469 40eb10 67 API calls std::exception::exception 47458->47469 47460->47458 47462 44fcf0 __cinit 74 API calls 47460->47462 47461 44fe83 47470 453fbc RaiseException 47461->47470 47462->47458 47464 44fe91 47471 409610 47465->47471 47468->47455 47469->47461 47470->47464 47472 40964b 47471->47472 47473 40961f 47471->47473 47475 44fe2d std::_Mutex::_Mutex 75 API calls 47472->47475 47479 44fea3 67 API calls 3 library calls 47473->47479 47477 40381d 47475->47477 47476 409634 47480 453fbc RaiseException 47476->47480 47477->47097 47479->47476 47480->47472 47481->47102 47482->47102 47483->47102 47484->47102 47485->47109 47486->47102 47488 40e54b 47487->47488 47489 40e584 __setlocale_set_cat 47488->47489 47490 40e55a InterlockedDecrement 47488->47490 47491 40e565 ~_Mpunct 47488->47491 47489->47134 47490->47491 47552 40e4a0 75 API calls numpunct 47491->47552 47494 406bb0 111 API calls 47493->47494 47495 4058e8 47494->47495 47553 40f080 47495->47553 47501 405945 47582 40dc30 47501->47582 47503 405980 47504 405992 47503->47504 47528 405a49 __setlocale_set_cat ~_Mpunct 47503->47528 47510 4059a3 47504->47510 47616 450237 6 API calls __vswprintf_s_l 47504->47616 47505 405a30 47592 405720 47505->47592 47508 405bfe 47520 405c21 ctype 47508->47520 47624 408050 88 API calls _DebugHeapAllocator 47508->47624 47510->47505 47521 405a35 47510->47521 47617 450237 6 API calls __vswprintf_s_l 47510->47617 47618 450cc8 79 API calls 2 library calls 47510->47618 47513 405ac4 lstrlenW 47513->47528 47516 405b1f InterlockedDecrement 47516->47528 47517 405ccd ~_Mpunct 47522 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 47517->47522 47518 405cbf InterlockedDecrement 47518->47517 47520->47517 47520->47518 47619 408050 88 API calls _DebugHeapAllocator 47521->47619 47525 405cfa 47522->47525 47524 450237 6 API calls _DebugHeapAllocator 47524->47528 47530 405d00 47525->47530 47527 405bd1 lstrlenW 47527->47528 47528->47505 47528->47513 47528->47516 47528->47524 47528->47527 47529 40e540 76 API calls 47528->47529 47620 40d760 82 API calls __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 47528->47620 47621 40e4a0 75 API calls numpunct 47528->47621 47622 408050 88 API calls _DebugHeapAllocator 47528->47622 47623 4054c0 120 API calls 2 library calls 47528->47623 47529->47528 47669 40a220 InterlockedDecrement InterlockedDecrement ~_Mpunct ctype 47530->47669 47532 405d3a 47533 40d850 83 API calls 47532->47533 47534 405d5b 47533->47534 47670 406b00 47534->47670 47537 405d8e 47539 405da3 InterlockedDecrement 47537->47539 47540 405db1 ~_Mpunct 47537->47540 47539->47540 47541 405e3d 47540->47541 47542 40d850 83 API calls 47540->47542 47541->47138 47543 405dcb 47542->47543 47677 409740 89 API calls 2 library calls 47543->47677 47545 405ddc 47546 405e00 47545->47546 47678 40a7b0 79 API calls _DebugHeapAllocator 47545->47678 47548 405e1d ~_Mpunct 47546->47548 47549 405e0f InterlockedDecrement 47546->47549 47548->47138 47549->47548 47550 405df9 47679 409460 80 API calls 47550->47679 47552->47489 47554 44fe2d std::_Mutex::_Mutex 75 API calls 47553->47554 47555 4058f8 47554->47555 47556 407770 47555->47556 47557 4078d0 ctype 47556->47557 47558 4077ba 47556->47558 47559 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 47557->47559 47561 40dc30 75 API calls 47558->47561 47560 405910 GetUserDefaultUILanguage 47559->47560 47569 4053e0 47560->47569 47568 4077eb ctype 47561->47568 47562 4078bb 47562->47557 47628 4076d0 75 API calls _DebugHeapAllocator 47562->47628 47566 40d8e0 75 API calls 47566->47568 47568->47562 47568->47566 47625 408140 75 API calls 47568->47625 47626 4076d0 75 API calls _DebugHeapAllocator 47568->47626 47627 40d980 75 API calls 2 library calls 47568->47627 47629 4054c0 120 API calls 2 library calls 47569->47629 47571 40541c 47572 405421 47571->47572 47573 40548a lstrlenW 47571->47573 47574 406bb0 111 API calls 47572->47574 47575 40e540 76 API calls 47573->47575 47577 405437 47574->47577 47576 4054a1 47575->47576 47576->47501 47578 40e2a0 78 API calls 47577->47578 47579 405448 47578->47579 47580 405465 ~_Mpunct 47579->47580 47581 405457 InterlockedDecrement 47579->47581 47580->47501 47581->47580 47583 40dc81 47582->47583 47585 40dc38 47582->47585 47630 40dbd0 47583->47630 47585->47583 47588 40dc62 47585->47588 47586 40dc8f 47589 40dcb1 47586->47589 47638 44fd95 67 API calls 3 library calls 47586->47638 47637 40d980 75 API calls 2 library calls 47588->47637 47589->47503 47591 40dc7c 47591->47503 47593 4057f8 47592->47593 47594 40572f GetUserDefaultUILanguage GetUserDefaultUILanguage 47592->47594 47593->47508 47595 405794 lstrlenW 47594->47595 47596 40575b 47594->47596 47606 40e540 76 API calls 47595->47606 47596->47595 47597 4057a0 47596->47597 47598 4057b3 47596->47598 47599 4057c6 47596->47599 47600 405769 47596->47600 47666 40e5c0 77 API calls 47597->47666 47667 40e5c0 77 API calls 47598->47667 47668 40e5c0 77 API calls 47599->47668 47604 405786 47600->47604 47605 405778 47600->47605 47665 40e5c0 77 API calls 47604->47665 47664 40e5c0 77 API calls 47605->47664 47611 4057f5 47606->47611 47608 4057c2 47608->47508 47609 4057d5 47609->47508 47611->47593 47613 4057af 47613->47508 47614 405782 47614->47508 47615 405790 47615->47508 47616->47510 47617->47510 47618->47510 47619->47505 47620->47528 47621->47528 47622->47528 47623->47528 47624->47520 47625->47568 47626->47568 47627->47568 47628->47557 47629->47571 47631 40dbe0 47630->47631 47632 40dbdb 47630->47632 47634 40dbfc 47631->47634 47639 40da90 47631->47639 47645 44d210 75 API calls 3 library calls 47632->47645 47634->47586 47636 40dbf2 47636->47586 47637->47591 47638->47589 47640 40dace 47639->47640 47646 40da30 47640->47646 47642 40db52 ctype 47642->47636 47643 40db03 47643->47642 47660 44fd95 67 API calls 3 library calls 47643->47660 47647 40da37 47646->47647 47648 40da49 47646->47648 47650 44fe2d std::_Mutex::_Mutex 75 API calls 47647->47650 47648->47647 47649 40da55 47648->47649 47661 44fea3 67 API calls 3 library calls 47649->47661 47652 40da42 47650->47652 47652->47643 47653 40da6a 47662 453fbc RaiseException 47653->47662 47655 40da81 47656 40da30 75 API calls 47655->47656 47657 40db03 47656->47657 47658 40db52 ctype 47657->47658 47663 44fd95 67 API calls 3 library calls 47657->47663 47658->47643 47660->47642 47661->47653 47662->47655 47663->47658 47664->47614 47665->47615 47666->47613 47667->47608 47668->47609 47669->47532 47671 406b13 47670->47671 47672 406b22 47671->47672 47680 450237 6 API calls __vswprintf_s_l 47671->47680 47675 405d7b 47672->47675 47681 450237 6 API calls __vswprintf_s_l 47672->47681 47675->47537 47676 450237 6 API calls __vswprintf_s_l 47675->47676 47676->47537 47677->47545 47678->47550 47679->47546 47680->47672 47681->47675 47683 453d5c __VEC_memzero 47682->47683 47683->47143 47737 456cfd GetLastError 47684->47737 47686 456d7e 47687 451cbd 47686->47687 47751 452ac6 67 API calls 3 library calls 47686->47751 47689 451056 47687->47689 47690 451062 __read 47689->47690 47691 456d76 __getptd 67 API calls 47690->47691 47692 451067 47691->47692 47693 451095 47692->47693 47695 451079 47692->47695 47694 457309 __lock 67 API calls 47693->47694 47696 45109c 47694->47696 47697 456d76 __getptd 67 API calls 47695->47697 47758 451018 75 API calls 3 library calls 47696->47758 47700 45107e 47697->47700 47699 4510af 47759 4510c0 LeaveCriticalSection _doexit 47699->47759 47702 45108c __read 47700->47702 47757 452ac6 67 API calls 3 library calls 47700->47757 47702->47166 47705 451014 47704->47705 47706 450ffb 47704->47706 47708 451db0 47705->47708 47706->47705 47707 450eca ___addlocaleref 8 API calls 47706->47707 47707->47705 47760 45722f LeaveCriticalSection 47708->47760 47710 451d0a 47711 451a67 47710->47711 47712 451a90 47711->47712 47719 451aac 47711->47719 47713 451a9a 47712->47713 47791 451765 114 API calls 11 library calls 47712->47791 47718 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 47713->47718 47714 451be3 47714->47713 47796 4513b7 71 API calls 6 library calls 47714->47796 47716 451bfd 47761 451534 47716->47761 47721 451c80 47718->47721 47719->47714 47719->47716 47725 451ae1 _strpbrk _strncmp _strcspn _strlen 47719->47725 47721->47178 47721->47179 47722 451c12 __setlocale_set_cat 47722->47713 47722->47714 47795 451765 114 API calls 11 library calls 47722->47795 47725->47713 47725->47714 47726 451b9b 47725->47726 47792 459fe3 67 API calls __vswprintf_s_l 47725->47792 47794 451765 114 API calls 11 library calls 47725->47794 47726->47725 47793 4500e9 10 API calls 3 library calls 47726->47793 47729->47162 47731->47186 47732->47188 47733->47191 47734->47169 47735->47182 47736->47169 47752 456b88 TlsGetValue 47737->47752 47740 456d6a SetLastError 47740->47686 47741 45517a __calloc_crt 64 API calls 47742 456d28 47741->47742 47742->47740 47743 456aed __decode_pointer 6 API calls 47742->47743 47744 456d42 47743->47744 47745 456d61 47744->47745 47746 456d49 47744->47746 47748 44fd07 ___init_time 64 API calls 47745->47748 47747 456c16 __mtinit 64 API calls 47746->47747 47749 456d51 GetCurrentThreadId 47747->47749 47750 456d67 47748->47750 47749->47740 47750->47740 47751->47687 47753 456b9d 47752->47753 47754 456bb8 47752->47754 47755 456aed __decode_pointer 6 API calls 47753->47755 47754->47740 47754->47741 47756 456ba8 TlsSetValue 47755->47756 47756->47754 47757->47702 47758->47699 47759->47700 47760->47710 47762 456d76 __getptd 67 API calls 47761->47762 47764 45156f 47762->47764 47763 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 47765 451763 47763->47765 47766 4515be 47764->47766 47768 45160f __setlocale_set_cat _strlen 47764->47768 47770 4515e7 47764->47770 47765->47722 47849 457e37 67 API calls __vswprintf_s_l 47766->47849 47779 4516eb __setlocale_set_cat 47768->47779 47797 451221 47768->47797 47769 4515d1 47769->47770 47771 4515da 47769->47771 47770->47763 47850 4500e9 10 API calls 3 library calls 47771->47850 47775 4515e4 47775->47770 47854 457e37 67 API calls __vswprintf_s_l 47779->47854 47781 4516a7 47852 459fe3 67 API calls __vswprintf_s_l 47781->47852 47782 451738 47782->47770 47783 45173f 47782->47783 47855 4500e9 10 API calls 3 library calls 47783->47855 47786 451749 47786->47770 47787 4516d3 47787->47779 47788 4516da 47787->47788 47853 4500e9 10 API calls 3 library calls 47788->47853 47790 4516e6 47790->47779 47791->47713 47792->47725 47793->47726 47794->47725 47795->47722 47796->47713 47800 45123a _memset 47797->47800 47798 451246 47798->47770 47810 45a653 47798->47810 47799 451285 _strcspn 47799->47798 47808 451307 47799->47808 47858 459fe3 67 API calls __vswprintf_s_l 47799->47858 47800->47798 47800->47799 47801 451258 47800->47801 47856 459fe3 67 API calls __vswprintf_s_l 47801->47856 47803 451269 47803->47798 47804 451270 47803->47804 47857 4500e9 10 API calls 3 library calls 47804->47857 47806 45127a 47806->47798 47808->47799 47859 4500e9 10 API calls 3 library calls 47808->47859 47811 456d76 __getptd 67 API calls 47810->47811 47815 45a660 47811->47815 47812 45a66f GetUserDefaultLCID 47837 45a6f2 47812->47837 47814 45a69b 47816 45a6fb 47814->47816 47818 45a6ad 47814->47818 47815->47812 47815->47814 47860 45a098 102 API calls _LanguageEnumProc@4 47815->47860 47816->47812 47819 45a706 _strlen 47816->47819 47821 45a6bf 47818->47821 47822 45a6b8 47818->47822 47826 45a70c EnumSystemLocalesA 47819->47826 47862 45a617 47821->47862 47861 45a5b0 EnumSystemLocalesA _GetPrimaryLen _strlen 47822->47861 47824 45a760 47829 45a785 IsValidCodePage 47824->47829 47834 45167d 47824->47834 47826->47837 47827 45a6bd 47827->47837 47866 45a098 102 API calls _LanguageEnumProc@4 47827->47866 47830 45a797 IsValidLocale 47829->47830 47829->47834 47831 45a7aa 47830->47831 47830->47834 47831->47834 47838 45a800 GetLocaleInfoA 47831->47838 47839 45a7db 47831->47839 47832 45a6f4 47836 45a617 _GetLcidFromLanguage EnumSystemLocalesA 47832->47836 47833 45a6db 47833->47832 47835 45a6ed 47833->47835 47833->47837 47834->47770 47851 45134a 67 API calls 3 library calls 47834->47851 47867 45a5b0 EnumSystemLocalesA _GetPrimaryLen _strlen 47835->47867 47836->47837 47837->47834 47868 45a0fa 94 API calls 3 library calls 47837->47868 47838->47834 47842 45a811 GetLocaleInfoA 47838->47842 47869 457e37 67 API calls __vswprintf_s_l 47839->47869 47842->47834 47844 45a825 47842->47844 47843 45a7e8 47843->47842 47845 45a7ef 47843->47845 47871 45609a 67 API calls _xtoa_s@20 47844->47871 47870 4500e9 10 API calls 3 library calls 47845->47870 47848 45a7fb 47848->47842 47849->47769 47850->47775 47851->47781 47852->47787 47853->47790 47854->47782 47855->47786 47856->47803 47857->47806 47858->47799 47859->47808 47860->47814 47861->47827 47863 45a61e _GetPrimaryLen _strlen 47862->47863 47864 45a638 EnumSystemLocalesA 47863->47864 47865 45a64e 47864->47865 47865->47827 47866->47833 47867->47837 47868->47824 47869->47843 47870->47848 47871->47834 47875 40296a 47872->47875 47873 4029bf 47874 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 47873->47874 47876 4029fe 47874->47876 47875->47873 47890 406ab0 47875->47890 47876->47196 47878 402b18 47894 4043a0 47878->47894 47881 402b40 SysFreeString 47881->47873 47882 406ab0 2 API calls 47886 402b6f 47882->47886 47883 402a3e 47883->47878 47884 402aa9 SysFreeString 47883->47884 47884->47873 47887 406ab0 2 API calls 47886->47887 47888 402b3f 47887->47888 47888->47881 47889 402be7 47888->47889 47891 406ab6 SysFreeString 47890->47891 47892 406ace 47890->47892 47891->47892 47893 406ac1 SysAllocString 47891->47893 47892->47883 47893->47892 47895 4043be 47894->47895 47896 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 47895->47896 47897 402b3a 47896->47897 47897->47882 47897->47888 47899 450893 47898->47899 47900 4508af 47898->47900 47919 4552a8 67 API calls __getptd_noexit 47899->47919 47902 456b88 ___set_flsgetvalue 8 API calls 47900->47902 47904 4508b5 47902->47904 47903 450898 47920 450211 6 API calls 2 library calls 47903->47920 47906 45517a __calloc_crt 67 API calls 47904->47906 47907 4508c1 47906->47907 47908 450913 47907->47908 47910 456d76 __getptd 67 API calls 47907->47910 47909 44fd07 ___init_time 67 API calls 47908->47909 47911 450919 47909->47911 47912 4508ce 47910->47912 47913 403ac0 47911->47913 47921 4552ce 67 API calls 3 library calls 47911->47921 47914 456c16 __mtinit 67 API calls 47912->47914 47913->47202 47916 4508d7 CreateThread 47914->47916 47916->47913 47918 45090a GetLastError 47916->47918 47922 4507fc 47916->47922 47918->47908 47919->47903 47921->47913 47923 456b88 ___set_flsgetvalue 8 API calls 47922->47923 47924 450807 47923->47924 47937 456b68 TlsGetValue 47924->47937 47927 450816 47947 456bbc 6 API calls __decode_pointer 47927->47947 47928 450840 47948 456d90 76 API calls 6 library calls 47928->47948 47930 45085b __IsNonwritableInCurrentImage 47939 4507bb 47930->47939 47932 450825 47934 450836 GetCurrentThreadId 47932->47934 47935 450829 GetLastError ExitThread 47932->47935 47934->47930 47938 450812 47937->47938 47938->47927 47938->47928 47940 4507c7 __read 47939->47940 47941 456d76 __getptd 67 API calls 47940->47941 47942 4507cc 47941->47942 47949 45077e 47942->47949 47944 4507dc 47945 458d8d __XcptFilter 67 API calls 47944->47945 47946 4507ed 47945->47946 47947->47932 47948->47930 47951 45078c __IsNonwritableInCurrentImage 47949->47951 47950 456cfd __getptd_noexit 67 API calls 47952 4507a6 47950->47952 47951->47950 47953 4507b1 ExitThread 47952->47953 47954 4507aa 47952->47954 47957 456ebf 79 API calls 2 library calls 47954->47957 47956 4507b0 47956->47953 47957->47956 47958->47208 47959->47218 47960->47276 47961->47276 47962->47276 47963->47276 47964->47295 47965->47306 47966->47308 47967->47310 47968->47311 47969->47324 47970->47326 47972 452c16 __read 47971->47972 47973 457309 __lock 67 API calls 47972->47973 47975 452c1d 47973->47975 47977 456aed __decode_pointer 6 API calls 47975->47977 47981 452cd6 __initterm 47975->47981 47979 452c54 47977->47979 47978 452d1e __read 47978->46893 47979->47981 47983 456aed __decode_pointer 6 API calls 47979->47983 47988 452d21 47981->47988 47982 452d15 47984 452b1a _malloc 3 API calls 47982->47984 47986 452c69 47983->47986 47984->47978 47985 456ae4 6 API calls FindHandlerForForeignException 47985->47986 47986->47981 47986->47985 47987 456aed 6 API calls __decode_pointer 47986->47987 47987->47986 47989 452d27 47988->47989 47990 452d02 47988->47990 47993 45722f LeaveCriticalSection 47989->47993 47990->47978 47992 45722f LeaveCriticalSection 47990->47992 47992->47982 47993->47990 47994 448040 47995 448076 TlsFree 47994->47995 47996 44807d 47994->47996 47995->47996 47997 448083 CloseHandle 47996->47997 47998 44808a 47996->47998 47997->47998 48001 448230 GetProcessHeap HeapFree 47998->48001 48000 44809a 48001->48000 48002 44c923 48003 44c8d1 48002->48003 48005 44c9c2 48003->48005 48006 44ca29 RaiseException 48005->48006 48007 44ca48 48005->48007 48009 44cbd6 48006->48009 48008 44cab5 LoadLibraryA 48007->48008 48007->48009 48011 44cb05 InterlockedExchange 48007->48011 48016 44cb40 48007->48016 48010 44cac4 GetLastError 48008->48010 48008->48011 48009->48003 48012 44cae4 RaiseException 48010->48012 48013 44cad6 48010->48013 48014 44cb13 48011->48014 48015 44cb39 FreeLibrary 48011->48015 48012->48009 48013->48011 48013->48012 48014->48016 48019 44cb19 LocalAlloc 48014->48019 48015->48016 48016->48009 48017 44cb8b GetProcAddress 48016->48017 48017->48009 48018 44cb9b GetLastError 48017->48018 48020 44cbad 48018->48020 48019->48016 48021 44cb27 48019->48021 48020->48009 48022 44cbbb RaiseException 48020->48022 48021->48016 48022->48009 48023 45a4ef 48024 456d76 __getptd 67 API calls 48023->48024 48025 45a50b _LcidFromHexString 48024->48025 48026 45a51a GetLocaleInfoA 48025->48026 48027 45a545 48026->48027 48031 45a53f 48026->48031 48036 4646ed 102 API calls 2 library calls 48027->48036 48029 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 48030 45a5ac 48029->48030 48031->48029 48032 45a550 48032->48031 48035 45a556 48032->48035 48037 4646ed 102 API calls 2 library calls 48032->48037 48035->48031 48038 45a2a9 6 API calls 4 library calls 48035->48038 48036->48032 48037->48035 48038->48031 48039 44c98e 48040 44c932 48039->48040 48041 44c9c2 10 API calls 48040->48041 48041->48040 48045 409f90 48046 409fcc 48045->48046 48048 409f97 ~_Mpunct 48045->48048 48047 409fad InterlockedDecrement 48047->48048 48048->48046 48048->48047 48049 458577 48059 4584fb 48049->48059 48052 4585a2 setSBCS 48053 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 48052->48053 48055 45875a 48053->48055 48054 4585e6 IsValidCodePage 48054->48052 48056 4585f8 GetCPInfo 48054->48056 48056->48052 48058 45860b _memset __setmbcp_nolock 48056->48058 48066 4582c4 GetCPInfo 48058->48066 48076 450665 48059->48076 48062 458538 48064 45852a 48062->48064 48065 45853d GetACP 48062->48065 48063 45851a GetOEMCP 48063->48064 48064->48052 48064->48054 48064->48058 48065->48064 48068 4582f8 _memset 48066->48068 48075 4583aa 48066->48075 48085 45c07e 48068->48085 48070 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 48072 458455 48070->48072 48072->48058 48074 454973 ___crtLCMapStringA 102 API calls 48074->48075 48075->48070 48077 450678 48076->48077 48080 4506c5 48076->48080 48078 456d76 __getptd 67 API calls 48077->48078 48079 45067d 48078->48079 48081 451056 _localeconv 75 API calls 48079->48081 48082 4506a5 48079->48082 48080->48062 48080->48063 48081->48082 48082->48080 48084 458457 69 API calls 6 library calls 48082->48084 48084->48080 48086 450665 _LocaleUpdate::_LocaleUpdate 77 API calls 48085->48086 48087 45c091 48086->48087 48095 45bec4 48087->48095 48090 454973 48091 450665 _LocaleUpdate::_LocaleUpdate 77 API calls 48090->48091 48092 454986 48091->48092 48122 4545ce 48092->48122 48096 45bee5 GetStringTypeW 48095->48096 48097 45bf10 48095->48097 48098 45bf05 GetLastError 48096->48098 48099 45befd 48096->48099 48097->48099 48100 45bff7 48097->48100 48098->48097 48101 45bf49 MultiByteToWideChar 48099->48101 48118 45bff1 48099->48118 48120 462bac 91 API calls 2 library calls 48100->48120 48108 45bf76 48101->48108 48101->48118 48103 45c01b 48107 45c048 GetStringTypeA 48103->48107 48103->48118 48121 462bf5 74 API calls 8 library calls 48103->48121 48104 45bf8b _memset _wcsupr_s_l_stat 48111 45bfc4 MultiByteToWideChar 48104->48111 48104->48118 48105 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 48106 458365 48105->48106 48106->48090 48112 45c063 48107->48112 48107->48118 48108->48104 48109 450a72 _malloc 67 API calls 48108->48109 48109->48104 48114 45bfeb 48111->48114 48115 45bfda GetStringTypeW 48111->48115 48116 44fd07 ___init_time 67 API calls 48112->48116 48113 45c03c 48113->48107 48113->48118 48119 4545ae 67 API calls ___init_time 48114->48119 48115->48114 48116->48118 48118->48105 48119->48118 48120->48103 48121->48113 48123 4545ef LCMapStringW 48122->48123 48126 45460a 48122->48126 48124 454612 GetLastError 48123->48124 48123->48126 48124->48126 48125 454808 48171 462bac 91 API calls 2 library calls 48125->48171 48126->48125 48127 454664 48126->48127 48128 45467d MultiByteToWideChar 48127->48128 48145 4547ff 48127->48145 48135 4546aa 48128->48135 48128->48145 48130 454830 48133 454924 LCMapStringA 48130->48133 48134 454849 48130->48134 48130->48145 48131 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 48132 454971 48131->48132 48132->48074 48136 454880 48133->48136 48172 462bf5 74 API calls 8 library calls 48134->48172 48140 450a72 _malloc 67 API calls 48135->48140 48149 4546c3 _wcsupr_s_l_stat 48135->48149 48139 45494b 48136->48139 48144 44fd07 ___init_time 67 API calls 48136->48144 48138 4546fb MultiByteToWideChar 48142 454714 LCMapStringW 48138->48142 48143 4547f6 48138->48143 48139->48145 48151 44fd07 ___init_time 67 API calls 48139->48151 48140->48149 48141 45485b 48141->48145 48146 454865 LCMapStringA 48141->48146 48142->48143 48148 454735 48142->48148 48170 4545ae 67 API calls ___init_time 48143->48170 48144->48139 48145->48131 48146->48136 48154 454887 48146->48154 48150 45473e 48148->48150 48153 454767 48148->48153 48149->48138 48149->48145 48150->48143 48152 454750 LCMapStringW 48150->48152 48151->48145 48152->48143 48159 454782 _wcsupr_s_l_stat 48153->48159 48161 450a72 _malloc 67 API calls 48153->48161 48156 450a72 _malloc 67 API calls 48154->48156 48160 454898 _memset _wcsupr_s_l_stat 48154->48160 48155 4547b6 LCMapStringW 48157 4547f0 48155->48157 48158 4547ce WideCharToMultiByte 48155->48158 48156->48160 48169 4545ae 67 API calls ___init_time 48157->48169 48158->48157 48159->48143 48159->48155 48160->48136 48163 4548d6 LCMapStringA 48160->48163 48161->48159 48165 4548f6 48163->48165 48166 4548f2 48163->48166 48173 462bf5 74 API calls 8 library calls 48165->48173 48174 4545ae 67 API calls ___init_time 48166->48174 48169->48143 48170->48145 48171->48130 48172->48141 48173->48166 48174->48136 48175 4701f0 48180 447b00 GetCurrentProcessId 48175->48180 48178 44fcf0 __cinit 74 API calls 48179 4701ff 48178->48179 48206 410610 48180->48206 48183 447b8e GetLastError 48186 447ba4 48183->48186 48187 447b9b WaitForSingleObject 48183->48187 48184 447c5a 48185 44fbba __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 48184->48185 48189 447c7a 48185->48189 48210 4478b0 GetProcessHeap HeapLock HeapWalk HeapWalk HeapUnlock 48186->48210 48187->48186 48189->48178 48190 447bac 48191 447bb0 48190->48191 48192 447bba GetProcessHeap 48190->48192 48193 447c3b ReleaseMutex 48191->48193 48194 447bd5 48192->48194 48195 447bc6 HeapAlloc 48192->48195 48193->48184 48196 447c53 CloseHandle 48193->48196 48197 447be7 48194->48197 48211 447f80 TlsAlloc RaiseException _memset __CxxThrowException@8 48194->48211 48195->48194 48196->48184 48199 447bf7 48197->48199 48200 447c0c 48197->48200 48212 453fbc RaiseException 48199->48212 48213 4479a0 GetProcessHeap HeapAlloc 48200->48213 48203 447c1a 48204 447c36 48203->48204 48214 453fbc RaiseException 48203->48214 48204->48193 48207 410616 48206->48207 48209 41063f CreateMutexW 48207->48209 48215 452224 103 API calls __vsnwprintf_l 48207->48215 48209->48183 48209->48184 48210->48190 48211->48197 48212->48200 48213->48203 48214->48204 48215->48209 48216 470090 48221 40f250 48216->48221 48219 44fcf0 __cinit 74 API calls 48220 47009f 48219->48220 48228 4106b0 75 API calls 48221->48228 48223 40f28d 48229 40f890 48223->48229 48226 40f890 75 API calls 48227 40f2ae 48226->48227 48227->48219 48228->48223 48230 44fe2d std::_Mutex::_Mutex 75 API calls 48229->48230 48231 40f8bc 48230->48231 48234 40ff70 48231->48234 48235 44fe2d std::_Mutex::_Mutex 75 API calls 48234->48235 48236 40f29f 48235->48236 48236->48226 48237 44d0f9 48238 44d0e3 48237->48238 48239 44c9c2 10 API calls 48238->48239 48240 44d0f0 48239->48240

                                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                                Function 004036F0 Relevance: 67.2, APIs: 13, Strings: 25, Instructions: 744COMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                control_flow_graph 0 4036f0-403743 call 4035d0 CoInitialize call 40d850 5 403813-40382a call 4096b0 call 4032b0 0->5 6 403749-40375b call 450298 0->6 16 403960-40397a call 405e60 call 403230 5->16 17 403830-403835 5->17 6->5 11 403761-403768 6->11 11->5 13 40376e-4037bc call 406440 call 4063e0 call 406370 GetModuleFileNameW call 4062a0 11->13 50 4037d8-4037e1 13->50 51 4037be-4037d0 13->51 39 403980-403987 16->39 40 403a5f-403a85 16->40 17->16 19 40383b-40385e call 403520 17->19 28 403860-403864 19->28 29 40387b-4038a7 call 403520 19->29 28->29 30 403866-403876 call 40e5f0 call 42da60 28->30 41 4038c0-4038c2 29->41 42 4038a9-4038b5 InterlockedDecrement 29->42 30->29 45 403a13-403a2a call 40a8d0 39->45 46 40398d-4039c6 call 4050c0 * 2 39->46 62 403a87-403a8c 40->62 63 403a8e 40->63 48 4038d0-4038d7 41->48 49 4038c4-4038ce 41->49 42->41 47 4038b7-4038bd call 4500cf 42->47 75 403a43-403a5c call 44fbba 45->75 76 403a2c-403a38 InterlockedDecrement 45->76 97 4039e6-4039f3 46->97 98 4039c8-4039d4 InterlockedDecrement 46->98 47->41 56 4038d9-403900 call 403520 48->56 57 403906 48->57 49->56 58 4037e3-4037ef InterlockedDecrement 50->58 59 4037fa-403810 call 44fbba 50->59 51->50 56->57 78 403902-403904 56->78 61 403908-40390d 57->61 58->59 60 4037f1-4037f7 call 4500cf 58->60 60->59 71 40391d-40391f 61->71 72 40390f-403918 call 409f60 61->72 73 403a93-403acd call 402f70 call 451c82 call 405000 call 402e50 call 404f50 call 42f540 call 42aae0 62->73 63->73 81 403921 71->81 82 40392b-403947 call 403520 71->82 72->71 118 403ad2-403ad4 73->118 76->75 84 403a3a-403a40 call 4500cf 76->84 78->61 81->82 82->16 96 403949-403955 InterlockedDecrement 82->96 84->75 96->16 101 403957-40395d call 4500cf 96->101 97->45 99 4039f5-403a01 InterlockedDecrement 97->99 98->97 102 4039d6-4039e3 call 4500cf 98->102 99->45 104 403a03-403a10 call 4500cf 99->104 101->16 102->97 104->45 119 403b42-403b6a call 401000 call 42fa50 call 4272b0 call 4272f0 call 42a040 call 414340 118->119 120 403ad6-403ae3 IsWindow 118->120 145 403bd1-403c14 call 453d50 GetTempPathW 119->145 146 403b6c-403b72 119->146 121 403ae5-403aee 120->121 122 403b2f-403b39 call 40a8d0 120->122 129 403af0-403af2 121->129 130 403af4 121->130 122->119 132 403af6-403b2c 129->132 130->132 132->122 160 403c1a-403c20 145->160 161 403ccd-403d17 call 40ae70 call 409950 call 40d760 call 4026f0 call 40d760 145->161 147 403bb0-403bcc call 42a0a0 call 40a8d0 call 409f60 146->147 148 403b74-403bab call 4050c0 * 2 call 418c40 call 409f60 * 2 146->148 147->145 148->147 165 403c26-403c6b call 4050c0 * 2 call 418c40 call 409f60 * 2 160->165 166 403f5e-403f7a call 42a0a0 call 40a8d0 call 409f60 160->166 199 403d24-403d34 call 40d760 161->199 200 403d19-403d22 call 4026f0 161->200 205 403f01-403f59 call 4050c0 * 2 call 418c40 call 409f60 * 2 call 42a0a0 call 40a8d0 call 409f60 165->205 206 403c71-403c86 call 404d40 165->206 194 403f7f-403f8e call 42c3f0 call 42c5b0 166->194 212 403f94-403f9b call 42c810 194->212 213 40410b-404112 194->213 215 403d41-403d51 call 40d760 199->215 216 403d36-403d3f call 4026f0 199->216 200->199 205->166 221 403cc4-403cc8 call 409f60 206->221 222 403c88-403cbb call 4050c0 * 2 call 418c40 call 409f60 206->222 212->213 237 403fa1-403fb3 call 427dc0 212->237 224 404130-404159 call 409e00 call 409f60 * 2 call 42a0a0 213->224 225 404114-40412b call 4050c0 call 418a80 call 409f60 213->225 234 403d53-403d5c call 4026f0 215->234 235 403d5e-403d9a call 40d760 call 406bb0 call 40e2a0 call 409f60 215->235 216->215 221->161 222->221 283 40415a-40417f call 40a8d0 call 409f60 call 44fbba 224->283 225->224 234->235 290 403da7-403de3 call 40d760 call 406bb0 call 40e2a0 call 409f60 235->290 291 403d9c-403da5 call 4026f0 235->291 258 403fc4-403fe2 call 42d660 call 42d360 237->258 259 403fb5-403fbf call 404f50 call 42f390 237->259 295 403ff0-403ffa 258->295 296 403fe4-403fee 258->296 259->258 328 403df0-403e2c call 40d760 call 406bb0 call 40e2a0 call 409f60 290->328 329 403de5-403dee call 4026f0 290->329 291->290 309 404008-404010 295->309 310 403ffc-404006 295->310 301 404017-40401f call 41c270 296->301 314 404021-404054 call 427e70 call 409e00 call 409f60 * 2 call 42a0a0 301->314 315 404059-40406d call 414e70 301->315 309->301 313 404012-404015 309->313 310->301 313->301 313->315 314->283 324 404074-404108 call 402fd0 call 42ab60 Sleep call 402ea0 call 4048b0 call 404f50 call 42f520 call 427e70 call 409e00 call 409f60 * 2 call 42a0a0 call 40a8d0 call 409f60 call 44fbba 315->324 325 40406f call 402370 315->325 325->324 354 403e2e-403e39 call 4026f0 328->354 355 403e3f-403e46 328->355 329->328 354->194 354->355 358 403e98 355->358 359 403e48-403e96 call 4050c0 * 3 call 418e10 355->359 361 403e9d-403ea4 358->361 359->358 359->361 365 403eb2-403eb5 361->365 366 403ea6-403ead call 409f60 361->366 370 403ec3-403ec6 365->370 371 403eb7-403ebe call 409f60 365->371 366->365 375 403ed1-403ed6 370->375 376 403ec8-403ecc call 409f60 370->376 371->370 380 403ee5-403ef8 call 409e00 call 409f60 375->380 381 403ed8-403ee2 call 449660 375->381 376->375 380->205 381->380
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 004035D0: _memset.LIBCMT ref: 00403612
                                                                                                                                                                                                                                  • Part of subcall function 004035D0: _memset.LIBCMT ref: 00403629
                                                                                                                                                                                                                                  • Part of subcall function 004035D0: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040363B
                                                                                                                                                                                                                                  • Part of subcall function 004035D0: PathAppendW.SHLWAPI(00000000,00000000), ref: 0040366E
                                                                                                                                                                                                                                  • Part of subcall function 004035D0: GetModuleHandleW.KERNEL32(Kernel32.dll,AddDllDirectory), ref: 00403687
                                                                                                                                                                                                                                  • Part of subcall function 004035D0: GetProcAddress.KERNEL32(00000000), ref: 0040368A
                                                                                                                                                                                                                                  • Part of subcall function 004035D0: LoadLibraryExW.KERNEL32(00000000,00000000,-00000800), ref: 004036AC
                                                                                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 0040372A
                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,/runonce), ref: 0040379E
                                                                                                                                                                                                                                  • Part of subcall function 004062A0: GetCurrentProcessId.KERNEL32(429E9C66,?,?,?,771AE860,?,?,00000000,?,ini_url_default,?,?,?,?,?), ref: 004062CD
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004037E7
                                                                                                                                                                                                                                  • Part of subcall function 0042FA50: lstrlenW.KERNEL32(00479EC4,00479EC4,?,?,?,00403B4E), ref: 0042FAA4
                                                                                                                                                                                                                                  • Part of subcall function 0042FA50: lstrlenW.KERNEL32(Tahoma,Tahoma,?,?,?,00403B4E), ref: 0042FAC0
                                                                                                                                                                                                                                  • Part of subcall function 0042FA50: lstrlenW.KERNEL32(00479EB8,00479EB8,?,?,?,00403B4E), ref: 0042FADC
                                                                                                                                                                                                                                  • Part of subcall function 004272F0: GetModuleHandleW.KERNEL32(Kernel32.dll,AddDllDirectory,00403B5A), ref: 00427303
                                                                                                                                                                                                                                  • Part of subcall function 004272F0: GetProcAddress.KERNEL32(00000000), ref: 0042730A
                                                                                                                                                                                                                                  • Part of subcall function 004272F0: LoadLibraryExW.KERNEL32(Gdiplus.dll,00000000,-00000800,00403B5A), ref: 00427334
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004038AD
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040394D
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-000000F4), ref: 004039CC
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004039F9
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00403A30
                                                                                                                                                                                                                                • _setlocale.LIBCMT ref: 00403AA2
                                                                                                                                                                                                                                • IsWindow.USER32(?), ref: 00403ADB
                                                                                                                                                                                                                                  • Part of subcall function 00406440: lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00406455
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00403BE9
                                                                                                                                                                                                                                • GetTempPathW.KERNEL32(00000104,?,?,?,?), ref: 00403BFE
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedIncrement.KERNEL32(00000000), ref: 00405119
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedDecrement.KERNEL32(-0000000C), ref: 00405155
                                                                                                                                                                                                                                  • Part of subcall function 00418C40: InterlockedDecrement.KERNEL32(?), ref: 00418D63
                                                                                                                                                                                                                                  • Part of subcall function 00418C40: InterlockedDecrement.KERNEL32(?), ref: 00418D85
                                                                                                                                                                                                                                  • Part of subcall function 00409F60: InterlockedDecrement.KERNEL32(-000000F4), ref: 00409F71
                                                                                                                                                                                                                                  • Part of subcall function 00409950: FindResourceW.KERNEL32(00400000,000001F6,FILE), ref: 004099BA
                                                                                                                                                                                                                                  • Part of subcall function 00409950: LoadResource.KERNEL32(00400000,00000000), ref: 004099D6
                                                                                                                                                                                                                                  • Part of subcall function 00409950: SizeofResource.KERNEL32(00400000,00000000), ref: 004099F1
                                                                                                                                                                                                                                  • Part of subcall function 00409950: FreeResource.KERNEL32(00000000), ref: 00409A03
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: LoadStringW.USER32(00400000,00477988,00000100,00000100), ref: 0040D78E
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: lstrlenW.KERNEL32(?,?,?,00477988), ref: 0040D7B5
                                                                                                                                                                                                                                  • Part of subcall function 004026F0: __wcsicoll.LIBCMT ref: 00402768
                                                                                                                                                                                                                                  • Part of subcall function 004026F0: __wcsicoll.LIBCMT ref: 004027CC
                                                                                                                                                                                                                                  • Part of subcall function 004026F0: __wcsicoll.LIBCMT ref: 004027E2
                                                                                                                                                                                                                                  • Part of subcall function 004026F0: __wcsicoll.LIBCMT ref: 004027F8
                                                                                                                                                                                                                                  • Part of subcall function 004026F0: __wcsicoll.LIBCMT ref: 0040280E
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: LoadStringW.USER32(00400000,00477988,00000000,00000000), ref: 0040D7EE
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: lstrlenW.KERNEL32(00000000,?,?,00477988), ref: 0040D817
                                                                                                                                                                                                                                  • Part of subcall function 004026F0: __wcsicoll.LIBCMT ref: 00402824
                                                                                                                                                                                                                                  • Part of subcall function 004026F0: __wcsicoll.LIBCMT ref: 0040283C
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: lstrlenW.KERNEL32(?,?,429E9C66,?,00000000,IDS_QUIT,?,0046E828,000000FF,00403E61,?,?,ini_url_win10_tse,?), ref: 00405132
                                                                                                                                                                                                                                  • Part of subcall function 00418C40: lstrlenW.KERNEL32(?), ref: 00418C9F
                                                                                                                                                                                                                                  • Part of subcall function 00418C40: lstrlenW.KERNEL32(?,?), ref: 00418CBA
                                                                                                                                                                                                                                  • Part of subcall function 00418C40: InterlockedDecrement.KERNEL32(?), ref: 00418DB8
                                                                                                                                                                                                                                  • Part of subcall function 00418C40: InterlockedDecrement.KERNEL32(?), ref: 00418DDA
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$lstrlen$__wcsicoll$Load$Resource$Module_memset$AddressHandleLibraryPathProcString$AppendCurrentDirectoryFileFindFreeIncrementInitializeNameProcessSizeofSystemTempWindow_setlocale
                                                                                                                                                                                                                                • String ID: /runonce$/tsewin10$/tswin10$IDS_LOAD_P2SP_ERROR$IDS_MESSAGEBOX_NONET$IDS_OFFICIAL_SITE$IDS_QUIT$IDS_STR_TEMP_ERROR_CANNOTSETUP$IDS_STR_TEMP_PATHEXCEPTION$IDS_STR_TEMP_REPAIR_FAIL$IDS_TITLE$IDS_URL_ERROR$IDS_XP_NOT_SUPPORTED$Q360InstallerMainWnd$Q360InstallerMainWndSilent$\GG$chs$clientid$http://www.360totalsecurity.com$ini_url_default$ini_url_win10_ts$ini_url_win10_tse$open$pkg$show
                                                                                                                                                                                                                                • API String ID: 1583503004-3256962211
                                                                                                                                                                                                                                • Opcode ID: cc58aa3e01cc7ca7124b2507a505cb05cb77c88b8fd47faba627c686f0ffe881
                                                                                                                                                                                                                                • Instruction ID: 716cd08fd88ef7d62de1bde04a649975b8f9734b979328b7f160e05ca87f7a44
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: cc58aa3e01cc7ca7124b2507a505cb05cb77c88b8fd47faba627c686f0ffe881
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A242AF716043019BC610FF22D846B9F77A8AF84309F44493EF655772D2DB78AE09CB9A
                                                                                                                                                                                                                                Function 00447B00 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 114memorysynchronizationCOMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                control_flow_graph 407 447b00-447b88 GetCurrentProcessId call 410610 CreateMutexW 410 447b8e-447b99 GetLastError 407->410 411 447c5a-447c83 call 44fbba 407->411 413 447ba4-447bae call 4478b0 410->413 414 447b9b-447b9e WaitForSingleObject 410->414 418 447bb0-447bb5 413->418 419 447bba-447bc4 GetProcessHeap 413->419 414->413 420 447c3b-447c51 ReleaseMutex 418->420 421 447bd5-447bde 419->421 422 447bc6-447bd3 HeapAlloc 419->422 420->411 423 447c53-447c54 CloseHandle 420->423 424 447be0-447be7 call 447f80 421->424 425 447be9 421->425 422->421 423->411 427 447beb-447bf5 424->427 425->427 429 447bf7-447c07 call 453fbc 427->429 430 447c0c-447c1f call 4479a0 427->430 429->430 434 447c36 430->434 435 447c21-447c31 call 453fbc 430->435 434->420 435->434
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(429E9C66,?,?,?,?,?,?,?,0046AF1B,000000FF), ref: 00447B46
                                                                                                                                                                                                                                  • Part of subcall function 00410610: _vswprintf_s.LIBCMT ref: 0041063A
                                                                                                                                                                                                                                • CreateMutexW.KERNEL32(00000000,00000001,?,?,?,?,?,?,?,?,0046AF1B,000000FF), ref: 00447B7B
                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0046AF1B,000000FF), ref: 00447B8E
                                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?,?,0046AF1B,000000FF), ref: 00447B9E
                                                                                                                                                                                                                                • GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,0046AF1B,000000FF), ref: 00447BBC
                                                                                                                                                                                                                                • HeapAlloc.KERNEL32(00000000,00000000,000005C0,?,?,?,?,?,?,?,?,0046AF1B,000000FF), ref: 00447BCD
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00447C07
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00447C31
                                                                                                                                                                                                                                • ReleaseMutex.KERNEL32(00000000), ref: 00447C49
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00447C54
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Exception@8HeapMutexProcessThrow$AllocCloseCreateCurrentErrorHandleLastObjectReleaseSingleWait_vswprintf_s
                                                                                                                                                                                                                                • String ID: %s %u$1830B7BD-F7A3-4c4d-989B-C004DE465EDE
                                                                                                                                                                                                                                • API String ID: 3526415198-332789905
                                                                                                                                                                                                                                • Opcode ID: 09a1df6b4917a32f9d7c110d687474e933d7f8cb0564039851ebd10888b1349a
                                                                                                                                                                                                                                • Instruction ID: bbe8453530915c3d4a67408ac1727c2b23fb6b88ad158b7fd5843d63f96cb285
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 09a1df6b4917a32f9d7c110d687474e933d7f8cb0564039851ebd10888b1349a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F041F771904248AFEB209FA4DC85BAE77B4FB04304F50453EF909E7350EB7C5A498B99
                                                                                                                                                                                                                                Function 00409950 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 323COMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                control_flow_graph 523 409950-4099c8 FindResourceW 524 409dd5 523->524 525 4099ce-4099e4 LoadResource 523->525 528 409dd9-409dfc call 44fbba 524->528 526 409dca-409dcc 525->526 527 4099ea-409a00 SizeofResource 525->527 526->524 529 409dce-409dcf FreeResource 526->529 530 409a10-409a23 call 44d280 527->530 531 409a02-409a0b FreeResource 527->531 529->524 535 409a28-409a33 530->535 531->528 535->526 536 409a39-409a65 call 453d50 LockResource call 454dd0 535->536 541 409a67 536->541 542 409a6a-409ad8 call 40f080 call 407770 536->542 541->542 547 409ade-409ae4 542->547 548 409d3f-409d57 call 4500cf 542->548 550 409afc-409b15 547->550 554 409d59 548->554 555 409d5e-409d63 548->555 552 409b20-409b25 550->552 553 409b17-409b1c call 450237 550->553 557 409b27-409b2b 552->557 558 409b2d 552->558 553->552 554->555 559 409d72-409d8d 555->559 560 409d65-409d6f call 44fbaf 555->560 562 409b31-409b4d 557->562 558->562 564 409dad-409dc7 call 44fbaf 559->564 565 409d8f-409daa call 4070e0 call 44fbaf 559->565 560->559 566 409b50-409b59 562->566 564->526 565->564 566->566 570 409b5b-409bac call 40dc30 call 407910 * 3 566->570 583 409c0e-409c11 570->583 584 409bae-409bb1 570->584 585 409d07-409d14 583->585 586 409c17-409c67 call 408140 * 2 583->586 584->583 587 409bb3-409bf5 call 408140 call 40d980 call 40d8b0 584->587 590 409d23-409d35 585->590 591 409d16-409d1a 585->591 603 409c70-409c7e 586->603 604 409c69 586->604 609 409bf7 587->609 610 409bfb-409c09 call 4080c0 587->610 592 409af0-409af8 590->592 593 409d3b 590->593 596 409d1b-409d20 call 44fbaf 591->596 592->550 593->548 596->590 606 409c80 603->606 607 409c87-409c8f 603->607 604->603 606->607 611 409c91 607->611 612 409c95-409ca7 call 409870 607->612 609->610 619 409cf2-409cfe 610->619 611->612 617 409cb9-409ce0 612->617 618 409ca9-409cb6 call 44fbaf 612->618 617->619 621 409ce2-409cef call 44fbaf 617->621 618->617 619->590 622 409d00-409d05 619->622 621->619 622->596
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • FindResourceW.KERNEL32(00400000,000001F6,FILE), ref: 004099BA
                                                                                                                                                                                                                                • LoadResource.KERNEL32(00400000,00000000), ref: 004099D6
                                                                                                                                                                                                                                • SizeofResource.KERNEL32(00400000,00000000), ref: 004099F1
                                                                                                                                                                                                                                • FreeResource.KERNEL32(00000000), ref: 00409A03
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00409A40
                                                                                                                                                                                                                                • LockResource.KERNEL32(00000000,?,?,?,?), ref: 00409A49
                                                                                                                                                                                                                                • FreeResource.KERNEL32(00000000), ref: 00409DCF
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Resource$Free$FindLoadLockSizeof_memset
                                                                                                                                                                                                                                • String ID: D{G$FILE
                                                                                                                                                                                                                                • API String ID: 22797042-2613583879
                                                                                                                                                                                                                                • Opcode ID: 77c7b58f08329aa53cc73c1de2f2f04d324d7e0c9b8ba446f960d4caa0c3dbef
                                                                                                                                                                                                                                • Instruction ID: cb321e18fb3b855a0c155843125368931fafc74e9dad5dd852d057ff915efd58
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 77c7b58f08329aa53cc73c1de2f2f04d324d7e0c9b8ba446f960d4caa0c3dbef
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E1C1BE719083808BD724DF28C891B5BB7E5BF85314F14493EF58997292DB39A848CB9B
                                                                                                                                                                                                                                Function 0044C9C2 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209libraryCOMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                control_flow_graph 437 44c9c2-44ca27 438 44ca48-44ca72 437->438 439 44ca29-44ca43 RaiseException 437->439 441 44ca74 438->441 442 44ca77-44ca83 438->442 440 44cbf8-44cbfc 439->440 441->442 443 44ca85-44ca90 442->443 444 44ca96-44ca98 442->444 443->444 452 44cbdb-44cbe2 443->452 445 44cb40-44cb4a 444->445 446 44ca9e-44caa5 444->446 448 44cb56-44cb58 445->448 449 44cb4c-44cb54 445->449 450 44cab5-44cac2 LoadLibraryA 446->450 451 44caa7-44cab3 446->451 453 44cbd6-44cbd9 448->453 454 44cb5a-44cb5d 448->454 449->448 455 44cac4-44cad4 GetLastError 450->455 456 44cb05-44cb11 InterlockedExchange 450->456 451->450 451->456 462 44cbe4-44cbf1 452->462 463 44cbf6 452->463 453->452 465 44cb5f-44cb62 454->465 466 44cb8b-44cb99 GetProcAddress 454->466 457 44cae4-44cb00 RaiseException 455->457 458 44cad6-44cae2 455->458 459 44cb13-44cb17 456->459 460 44cb39-44cb3a FreeLibrary 456->460 457->440 458->456 458->457 459->445 469 44cb19-44cb25 LocalAlloc 459->469 460->445 462->463 463->440 465->466 467 44cb64-44cb6f 465->467 466->453 468 44cb9b-44cbab GetLastError 466->468 467->466 470 44cb71-44cb77 467->470 472 44cbb7-44cbb9 468->472 473 44cbad-44cbb5 468->473 469->445 474 44cb27-44cb37 469->474 470->466 475 44cb79-44cb7c 470->475 472->453 476 44cbbb-44cbd3 RaiseException 472->476 473->472 474->445 475->466 477 44cb7e-44cb89 475->477 476->453 477->453 477->466
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0044CA3B
                                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(?), ref: 0044CAB8
                                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 0044CAC4
                                                                                                                                                                                                                                • RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0044CAF7
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ExceptionRaise$ErrorLastLibraryLoad
                                                                                                                                                                                                                                • String ID: $
                                                                                                                                                                                                                                • API String ID: 948315288-3993045852
                                                                                                                                                                                                                                • Opcode ID: da39ec4e07230c186a2382151099648e7433bdb99c6cc685440f535aaab9e6b8
                                                                                                                                                                                                                                • Instruction ID: ec86aa28e4cfd6eb6f8c799c5f6e4b0eb77306e2ef2eba1cf1240b8ac25d2e5b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: da39ec4e07230c186a2382151099648e7433bdb99c6cc685440f535aaab9e6b8
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C5815C71A016459FEB50CFA8D8C1BAEB7F5EF48310F14802AE905E7350EB74E945CB68
                                                                                                                                                                                                                                Function 0042C460 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 116COMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • MoveFileExW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,0042C448), ref: 0042C4A9
                                                                                                                                                                                                                                  • Part of subcall function 00411010: lstrlenW.KERNEL32(\liveupdatelog,429E9C66,00000000,00000000,\liveupdatelog,?,0046C8B9,000000FF,0042C659,?,?,00000000,00000000), ref: 00411058
                                                                                                                                                                                                                                • MoveFileExW.KERNEL32(?,00000000,00000004,00000004,?), ref: 0042C4C5
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9B72), ref: 0042C4E0
                                                                                                                                                                                                                                • MoveFileExW.KERNEL32(?,00000000,00000004,00000004,?,?,00000000,00000004,00000004,?), ref: 0042C50D
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9B72), ref: 0042C522
                                                                                                                                                                                                                                • MoveFileExW.KERNEL32(?,00000000,00000004,?,00000000,00000004,00000004,?,?,00000000,00000004,00000004,?), ref: 0042C53F
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042C553
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042C579
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • \liveupdatelog, xrefs: 0042C4FC
                                                                                                                                                                                                                                • \liveupdatelog\P2SP_360installer.log, xrefs: 0042C4B4
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementFileInterlockedMove$lstrlen
                                                                                                                                                                                                                                • String ID: \liveupdatelog$\liveupdatelog\P2SP_360installer.log
                                                                                                                                                                                                                                • API String ID: 2692540430-4072175126
                                                                                                                                                                                                                                • Opcode ID: 071b028e06c0aaf1adec8963390275101ca0abc134bc0f7879bc96d8300e335d
                                                                                                                                                                                                                                • Instruction ID: 2b4859f7a1960ce3a9667ccf32ee68d3ea3b45072034ec898cb8abf9d18d9ddd
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 071b028e06c0aaf1adec8963390275101ca0abc134bc0f7879bc96d8300e335d
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5E31B3F2604602AFD210DB68EC86F5BB3E8EF44724F504A1AF5259B2D1E738E8448759
                                                                                                                                                                                                                                Function 004035D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 87libraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00403612
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00403629
                                                                                                                                                                                                                                • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040363B
                                                                                                                                                                                                                                • PathAppendW.SHLWAPI(00000000,00000000), ref: 0040366E
                                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(Kernel32.dll,AddDllDirectory), ref: 00403687
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 0040368A
                                                                                                                                                                                                                                • LoadLibraryExW.KERNEL32(00000000,00000000,-00000800), ref: 004036AC
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$AddressAppendDirectoryHandleLibraryLoadModulePathProcSystem
                                                                                                                                                                                                                                • String ID: 3$AddDllDirectory$Kernel32.dll
                                                                                                                                                                                                                                • API String ID: 3095357391-545666594
                                                                                                                                                                                                                                • Opcode ID: cde4cf22398b2f0a089a682bccbd91658743e6a591a9267f5496f33415b7fa6f
                                                                                                                                                                                                                                • Instruction ID: 1f22c48b3edec4e0beda5b31e05bdc8e59e48073e3c0311e7ec3e60e9492e938
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: cde4cf22398b2f0a089a682bccbd91658743e6a591a9267f5496f33415b7fa6f
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3121A1716513006BE310AB34DC4AB6B77A8EF54705F400A3FF90AD62D2EB7D9688875E
                                                                                                                                                                                                                                Function 0042AAE0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 41synchronizationCOMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • CreateMutexW.KERNEL32(00000000,00000001,Q360SafeInstallerMutex,?,00000000,?,?,00403AD2), ref: 0042AAED
                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00403AD2), ref: 0042AAFD
                                                                                                                                                                                                                                • FindCloseChangeNotification.KERNEL32(00000000,?,00403AD2), ref: 0042AB0B
                                                                                                                                                                                                                                • FindWindowW.USER32(Q360InstallerMainWnd,00000000), ref: 0042AB18
                                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(0048F19C,?,00403AD2), ref: 0042AB35
                                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(0048F19C,?,00403AD2), ref: 0042AB4E
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CriticalFindSection$ChangeCloseCreateEnterErrorLastLeaveMutexNotificationWindow
                                                                                                                                                                                                                                • String ID: Q360InstallerMainWnd$Q360SafeInstallerMutex$x.l
                                                                                                                                                                                                                                • API String ID: 4174684943-111785568
                                                                                                                                                                                                                                • Opcode ID: 8d1e1867fda805a845e85c732bf703356b3375910365e9d969edbcc964ce1585
                                                                                                                                                                                                                                • Instruction ID: c9cce9098337cb3c27ef985866f07f25ec8f471889c82727ea448e6f3c4966da
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8d1e1867fda805a845e85c732bf703356b3375910365e9d969edbcc964ce1585
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6EF0F432301251AFD2106B64EC4DF8E7B55EB85B62F208437F909E1290C7784884877E
                                                                                                                                                                                                                                Function 004507FC Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • ___set_flsgetvalue.LIBCMT ref: 00450802
                                                                                                                                                                                                                                  • Part of subcall function 00456B88: TlsGetValue.KERNEL32(?,00450807), ref: 00456B91
                                                                                                                                                                                                                                  • Part of subcall function 00456B88: __decode_pointer.LIBCMT ref: 00456BA3
                                                                                                                                                                                                                                  • Part of subcall function 00456B88: TlsSetValue.KERNEL32(00000000,00450807), ref: 00456BB2
                                                                                                                                                                                                                                • ___fls_getvalue@4.LIBCMT ref: 0045080D
                                                                                                                                                                                                                                  • Part of subcall function 00456B68: TlsGetValue.KERNEL32(?,?,00450812,00000000), ref: 00456B76
                                                                                                                                                                                                                                • ___fls_setvalue@8.LIBCMT ref: 00450820
                                                                                                                                                                                                                                  • Part of subcall function 00456BBC: __decode_pointer.LIBCMT ref: 00456BCD
                                                                                                                                                                                                                                • GetLastError.KERNEL32(00000000,?,00000000), ref: 00450829
                                                                                                                                                                                                                                • ExitThread.KERNEL32 ref: 00450830
                                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00450836
                                                                                                                                                                                                                                • __freefls@4.LIBCMT ref: 00450856
                                                                                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00450869
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1925773019-0
                                                                                                                                                                                                                                • Opcode ID: 74afa69bfaa04b6c04b391fb1aeb1dc85becd17e3961e933e0290fa63564515a
                                                                                                                                                                                                                                • Instruction ID: c26a2b31170bc0f4a7dbb5b4918cb74756f371d5775504191c22098e27a98f55
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 74afa69bfaa04b6c04b391fb1aeb1dc85becd17e3961e933e0290fa63564515a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AC014438500250ABC714BF7AD909D4A3B989F44356751842EFC49C7223DB3DD889CAAD
                                                                                                                                                                                                                                Function 00405E60 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 00409950: FindResourceW.KERNEL32(00400000,000001F6,FILE), ref: 004099BA
                                                                                                                                                                                                                                  • Part of subcall function 00409950: LoadResource.KERNEL32(00400000,00000000), ref: 004099D6
                                                                                                                                                                                                                                  • Part of subcall function 00409950: SizeofResource.KERNEL32(00400000,00000000), ref: 004099F1
                                                                                                                                                                                                                                  • Part of subcall function 00409950: FreeResource.KERNEL32(00000000), ref: 00409A03
                                                                                                                                                                                                                                  • Part of subcall function 00406BB0: InterlockedDecrement.KERNEL32(?), ref: 00406C54
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9B72), ref: 00405EDA
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(00490380), ref: 00405F31
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988,00477988,00490474,?,err_link), ref: 00405F51
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Resource$DecrementInterlocked$FindFreeLoadSizeoflstrlen
                                                                                                                                                                                                                                • String ID: channel$err_link$l
                                                                                                                                                                                                                                • API String ID: 308816364-95504027
                                                                                                                                                                                                                                • Opcode ID: d68bd1d23b9af844df550f7206431e88817e6bad5eb2f5d2ec8578f079729f84
                                                                                                                                                                                                                                • Instruction ID: b07bfa65f2b1a9563e8c42ee6c7ed228dbe429ec1081496792fade62bb98e435
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d68bd1d23b9af844df550f7206431e88817e6bad5eb2f5d2ec8578f079729f84
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7231D2B16047415FC600EB699C42B5BB794EF80728F540A3FB554A33D2DB7CD8048BAE
                                                                                                                                                                                                                                Function 0045087F Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                control_flow_graph 689 45087f-450891 690 450893-4508ad call 4552a8 call 450211 689->690 691 4508af-4508c7 call 456b88 call 45517a 689->691 700 45092b-45092e 690->700 701 450913-45091d call 44fd07 691->701 702 4508c9-4508eb call 456d76 call 456c16 691->702 707 45091f-450927 call 4552ce 701->707 708 450928 701->708 714 4508f0-450908 CreateThread 702->714 715 4508ed 702->715 707->708 711 45092a 708->711 711->700 714->711 716 45090a-450910 GetLastError 714->716 715->714 716->701
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • ___set_flsgetvalue.LIBCMT ref: 004508B0
                                                                                                                                                                                                                                • __calloc_crt.LIBCMT ref: 004508BC
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 004508C9
                                                                                                                                                                                                                                • CreateThread.KERNEL32(?,?,004507FC,00000000,?,?), ref: 00450900
                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 0045090A
                                                                                                                                                                                                                                • __dosmaperr.LIBCMT ref: 00450922
                                                                                                                                                                                                                                  • Part of subcall function 004552A8: __getptd_noexit.LIBCMT ref: 004552A8
                                                                                                                                                                                                                                  • Part of subcall function 00450211: __decode_pointer.LIBCMT ref: 0045021C
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1803633139-0
                                                                                                                                                                                                                                • Opcode ID: f298eae8304b520a050b00c65fad3a6eaccedec7f63f89292e816c62e9ac2e1b
                                                                                                                                                                                                                                • Instruction ID: 342f5c23058cfebb48521a5c04e6440ef7fccc8a0d0c27cb098161da786ce8c4
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f298eae8304b520a050b00c65fad3a6eaccedec7f63f89292e816c62e9ac2e1b
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3011E272500245AFDB10BFA5DC4289F7BA4EF0432AB20403FF90493153EB3999498B68
                                                                                                                                                                                                                                Function 0044FD07 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                control_flow_graph 717 44fd07-44fd18 call 453dcc 720 44fd8f-44fd94 call 453e11 717->720 721 44fd1a-44fd21 717->721 722 44fd66 721->722 723 44fd23-44fd3b call 457309 call 45733c 721->723 725 44fd67-44fd77 RtlFreeHeap 722->725 735 44fd46-44fd56 call 44fd5d 723->735 736 44fd3d-44fd45 call 45736c 723->736 725->720 728 44fd79-44fd8e call 4552a8 GetLastError call 455266 725->728 728->720 735->720 742 44fd58-44fd5b 735->742 736->735 742->725
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __lock.LIBCMT ref: 0044FD25
                                                                                                                                                                                                                                  • Part of subcall function 00457309: __mtinitlocknum.LIBCMT ref: 0045731F
                                                                                                                                                                                                                                  • Part of subcall function 00457309: __amsg_exit.LIBCMT ref: 0045732B
                                                                                                                                                                                                                                  • Part of subcall function 00457309: EnterCriticalSection.KERNEL32(?,?,?,00456E21,0000000D,0047EBC0,00000008,0045085B,?,00000000), ref: 00457333
                                                                                                                                                                                                                                • ___sbh_find_block.LIBCMT ref: 0044FD30
                                                                                                                                                                                                                                • ___sbh_free_block.LIBCMT ref: 0044FD3F
                                                                                                                                                                                                                                • RtlFreeHeap.NTDLL(00000000,?,0047E7E8,0000000C,00456D67,00000000,?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C), ref: 0044FD6F
                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C,00457324,?,?,?,00456E21,0000000D), ref: 0044FD80
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2714421763-0
                                                                                                                                                                                                                                • Opcode ID: c24295bf3b8d19fe9983cb7fbfc7db4c55bdeba2860151cd68053011dfb3e5a8
                                                                                                                                                                                                                                • Instruction ID: ab69129f207d06b5459529812792142862964c67e625879185f923b0da5cba7b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c24295bf3b8d19fe9983cb7fbfc7db4c55bdeba2860151cd68053011dfb3e5a8
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F701A771C056059AFB346FB2AC0676E37609F05766F64013FF806AA1A2DA3C8948DB5D
                                                                                                                                                                                                                                Function 00402920 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 288COMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                control_flow_graph 743 402920-40296c 745 402984-402989 743->745 746 40296e-40297d 743->746 747 4029e4 745->747 748 40298b-4029a3 745->748 746->745 749 4029e6-402a01 call 44fbba 747->749 753 4029d2-4029da 748->753 754 4029a5-4029bd 748->754 753->747 755 4029dc-4029e1 753->755 757 402a02-402a18 754->757 758 4029bf-4029c8 754->758 755->747 761 402a1a-402a23 757->761 762 402a2f-402a5d call 406ab0 757->762 758->753 759 4029ca-4029cf 758->759 759->753 761->758 763 402a25-402a2d 761->763 768 402a63-402a9c 762->768 769 402b1b-402b21 762->769 763->758 783 402b18 768->783 784 402a9e-402aa1 768->784 770 402b23-402b28 769->770 771 402b2b-402b3d call 4043a0 769->771 770->771 776 402b62-402bc5 call 406ab0 * 2 771->776 777 402b3f 771->777 805 402bca-402bd3 776->805 778 402b40-402b4f SysFreeString 777->778 778->761 780 402b55-402b5d 778->780 780->761 783->769 784->783 786 402aa3-402aa7 784->786 786->783 788 402aa9-402ab2 786->788 789 402ab4-402ab9 788->789 790 402abc-402acc SysFreeString 788->790 789->790 792 402ad6-402adf 790->792 793 402ace-402ad3 790->793 795 402ae1-402ae6 792->795 796 402ae9-402af2 792->796 793->792 795->796 797 402af4-402af9 796->797 798 402afc-402b04 796->798 797->798 799 402b06-402b0b 798->799 800 402b0e-402b13 798->800 799->800 800->749 806 402bd5-402bd7 805->806 807 402be7-402be9 805->807 808 402be1-402be2 806->808 809 402bd9-402bde 806->809 810 402bf3 807->810 811 402beb-402bf0 807->811 808->778 809->808 811->810
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • SysFreeString.OLEAUT32(?), ref: 00402ABD
                                                                                                                                                                                                                                • SysFreeString.OLEAUT32(?), ref: 00402B40
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • 360 Total Security Online Installer, xrefs: 00402B62
                                                                                                                                                                                                                                • HNetCfg.FwMgr, xrefs: 0040295F
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: FreeString
                                                                                                                                                                                                                                • String ID: 360 Total Security Online Installer$HNetCfg.FwMgr
                                                                                                                                                                                                                                • API String ID: 3341692771-3346489203
                                                                                                                                                                                                                                • Opcode ID: 72145c3245f0ea10a91bd8e4608863f7084c0801aa2f8112a4aef1f5e4257446
                                                                                                                                                                                                                                • Instruction ID: a638f7b243d5925ffd437ac123191b862f90b674c96f71c3792abcbbb2cf258d
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 72145c3245f0ea10a91bd8e4608863f7084c0801aa2f8112a4aef1f5e4257446
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A8B12975A00248EFCB10DFD8C984AAEB7B9BF89304F2485A9E505FB391C775AD46CB50
                                                                                                                                                                                                                                Function 0044FE2D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                control_flow_graph 812 44fe2d-44fe35 813 44fe44-44fe4f call 450a72 812->813 816 44fe37-44fe42 call 457e0f 813->816 817 44fe51-44fe52 813->817 816->813 820 44fe53-44fe5f 816->820 821 44fe61-44fe79 call 44fe12 call 44fcf0 820->821 822 44fe7a-44fe91 call 40eb10 call 453fbc 820->822 821->822
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0044FE47
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __FF_MSGBANNER.LIBCMT ref: 00450A95
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __NMSG_WRITE.LIBCMT ref: 00450A9C
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C,00457324), ref: 00450AE9
                                                                                                                                                                                                                                • std::bad_alloc::bad_alloc.LIBCMT ref: 0044FE6A
                                                                                                                                                                                                                                  • Part of subcall function 0044FE12: std::exception::exception.LIBCMT ref: 0044FE1E
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AllocateHeap_mallocstd::bad_alloc::bad_allocstd::exception::exception
                                                                                                                                                                                                                                • String ID: P+A$pH
                                                                                                                                                                                                                                • API String ID: 3447465555-2135452234
                                                                                                                                                                                                                                • Opcode ID: 3eb8c30ff632dbb6ddc75d3bba23383c7c0c0ba84bf56a200ba84cc70b925d57
                                                                                                                                                                                                                                • Instruction ID: 09d36e35b84593381237ba7c682739ee4a183130c14d9333f7c8d3c65f8eb526
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3eb8c30ff632dbb6ddc75d3bba23383c7c0c0ba84bf56a200ba84cc70b925d57
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: ACF0BE3150020826DB047723EC07A5E37684A4071DB2084BFAC01550A3DF6CDA1D964D
                                                                                                                                                                                                                                Function 0040DA30 Relevance: 4.6, APIs: 3, Instructions: 112COMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                control_flow_graph 831 40da30-40da35 832 40da37 831->832 833 40da49-40da53 831->833 834 40da39-40da3d call 44fe2d 832->834 833->834 835 40da55-40dacc call 44fea3 call 453fbc 833->835 838 40da42-40da48 834->838 843 40dad2-40dae4 835->843 844 40dace-40dad0 835->844 845 40daf4-40db33 call 40da30 843->845 846 40dae6-40daef 843->846 844->845 851 40db35-40db39 845->851 852 40db58-40db5c 845->852 846->845 848 40daf1 846->848 848->845 853 40db40 851->853 854 40db3b-40db3e 851->854 855 40db6d-40db7d 852->855 856 40db5e-40db6a call 44fbaf 852->856 859 40db43-40db55 call 44fd95 853->859 854->859 857 40db81-40db98 855->857 858 40db7f 855->858 856->855 858->857 859->852
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 0040DA65
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040DA7C
                                                                                                                                                                                                                                • _memcpy_s.LIBCMT ref: 0040DB4D
                                                                                                                                                                                                                                  • Part of subcall function 0044FE2D: _malloc.LIBCMT ref: 0044FE47
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Exception@8Throw_malloc_memcpy_sstd::exception::exception
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1787139365-0
                                                                                                                                                                                                                                • Opcode ID: 6ffa097ed06333a7b1abe921755930f6f95fcf16876d8b6706b938fc60c17001
                                                                                                                                                                                                                                • Instruction ID: 67c83daa4f2bb093e084a54962eef5427bec317224de4766e6fd7834f8d4c394
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6ffa097ed06333a7b1abe921755930f6f95fcf16876d8b6706b938fc60c17001
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A931E5B1E04204ABD704DF99C841A5BF3B5FB84314F10863FE82693681E774F518CAD9
                                                                                                                                                                                                                                Function 00448040 Relevance: 3.0, APIs: 2, Instructions: 33COMMON
                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                control_flow_graph 864 448040-448074 865 448076-448077 TlsFree 864->865 866 44807d-448081 864->866 865->866 867 448083-448084 CloseHandle 866->867 868 44808a-4480ab call 448230 866->868 867->868
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • TlsFree.KERNEL32(?,429E9C66,008D4568,?,00000000,0046AECB,000000FF,004480D6,008D4568,00447CA2), ref: 00448077
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,429E9C66,008D4568,?,00000000,0046AECB,000000FF,004480D6,008D4568,00447CA2), ref: 00448084
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CloseFreeHandle
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3660824471-0
                                                                                                                                                                                                                                • Opcode ID: ffeaec263f85f8ed12c47ced18f54844bb7ee2d998b26359b5627ca9f030ba98
                                                                                                                                                                                                                                • Instruction ID: 247038bf80471b43ba50de672c3c444177422c9c75f681dc492c8975d8b469a2
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ffeaec263f85f8ed12c47ced18f54844bb7ee2d998b26359b5627ca9f030ba98
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 41F03CB5504A409FD220CF28D944B5BB7E8FB04B20F104B2EE86593790D739E849CA66
                                                                                                                                                                                                                                Function 00406AB0 Relevance: 3.0, APIs: 2, Instructions: 17memoryCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • SysFreeString.OLEAUT32(00000000), ref: 00406AB7
                                                                                                                                                                                                                                • SysAllocString.OLEAUT32 ref: 00406AC2
                                                                                                                                                                                                                                  • Part of subcall function 0040C530: __CxxThrowException@8.LIBCMT ref: 0040C522
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: String$AllocException@8FreeThrow
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1688122297-0
                                                                                                                                                                                                                                • Opcode ID: 3a59950735a447829686f8054e4530713303f4421128a8726e6d09e9a27ee17c
                                                                                                                                                                                                                                • Instruction ID: ee8b9082eba47fb0bb93e98eabfcc486eb9804dd19be3c1fd855aafc47c12c57
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3a59950735a447829686f8054e4530713303f4421128a8726e6d09e9a27ee17c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 41D05E30A01223A7C7206B249858B1B7755EF41744B154536F803FB2C0EB7CD870CBD8
                                                                                                                                                                                                                                Function 00452B1A Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • ___crtCorExitProcess.LIBCMT ref: 00452B22
                                                                                                                                                                                                                                  • Part of subcall function 00452AEF: GetModuleHandleW.KERNEL32(mscoree.dll,?,00452B27,?,?,00450AAB,000000FF,0000001E,?,00455146,?,00000001,?,?,00457293,00000018), ref: 00452AF9
                                                                                                                                                                                                                                  • Part of subcall function 00452AEF: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00452B09
                                                                                                                                                                                                                                • ExitProcess.KERNEL32 ref: 00452B2B
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2427264223-0
                                                                                                                                                                                                                                • Opcode ID: fede0bb101435ee35c2ece51d0d8630bd7088ff720d69e63eed80d3f97ff2519
                                                                                                                                                                                                                                • Instruction ID: bc02f7453c41450cb301731d9681026eff5eee8b76143cc0a0b10f1093aef491
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fede0bb101435ee35c2ece51d0d8630bd7088ff720d69e63eed80d3f97ff2519
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A1B09231000148BBCF112F16DC0A84A3F6AEB813A1B504026F90849032DFB2ADD69A88
                                                                                                                                                                                                                                Function 0040DBD0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • std::_String_base::_Xlen.LIBCPMT ref: 0040DBDB
                                                                                                                                                                                                                                  • Part of subcall function 0044D210: __EH_prolog3.LIBCMT ref: 0044D217
                                                                                                                                                                                                                                  • Part of subcall function 0044D210: __CxxThrowException@8.LIBCMT ref: 0044D242
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1675473389-0
                                                                                                                                                                                                                                • Opcode ID: cf820cc20b0377accfd92dd6328ff3dd987af96403db3c8c6a9aaf9e2898edbc
                                                                                                                                                                                                                                • Instruction ID: 1cfe63f60e19a8362f102f22975cdc2e9188d74da611bdcfb788feff7e056aaa
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: cf820cc20b0377accfd92dd6328ff3dd987af96403db3c8c6a9aaf9e2898edbc
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7EF09031F181210ADA24AEB9AD4047B62E3AFD5710315CA3EE042DB1C4DD3498894258
                                                                                                                                                                                                                                Function 00409F90 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00409FB1
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3448037634-0
                                                                                                                                                                                                                                • Opcode ID: 62c75d7d3486fc2519a422d50faf61baf355021038c627eec0b078ea268d23ba
                                                                                                                                                                                                                                • Instruction ID: 9a90b5f99f453b413cb82cd8c9703685ab359e140ac3f41c22e51c4093b1046d
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 62c75d7d3486fc2519a422d50faf61baf355021038c627eec0b078ea268d23ba
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F1E0D8F38050120BC720792DEC8485BA3989FD032031A4A3BE965F33D6E639EC454598
                                                                                                                                                                                                                                Function 0045715D Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 00457172
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CreateHeap
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 10892065-0
                                                                                                                                                                                                                                • Opcode ID: 4a5b71a3ea91b43a4f7cdb383f887278528aac98f18a1fa407e5883786269136
                                                                                                                                                                                                                                • Instruction ID: 1e1dd3b1ea3e7ecfe77e81f980bb2a96fd9206fce041a47b855e4f236809390e
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4a5b71a3ea91b43a4f7cdb383f887278528aac98f18a1fa407e5883786269136
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 31D05E32954345AADB015FB57C097663BDCD798396F044836B90CC6260F574CA808648
                                                                                                                                                                                                                                Function 00402E50 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,00000104,00000104), ref: 00402E70
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: FileModuleName
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 514040917-0
                                                                                                                                                                                                                                • Opcode ID: 9fa9301e7b3d85c327401577f06c928586b019da87b4c07c278dd01be58f3c64
                                                                                                                                                                                                                                • Instruction ID: cf29576210e0b9740d2edc110e3fa400ff2b19ac1dbd80085adad605a8e66419
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9fa9301e7b3d85c327401577f06c928586b019da87b4c07c278dd01be58f3c64
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 51E0C2B06043408FE328FB10D85FBAEB3E0EB54B00F80092EA49D8A1E0E638584CCB47
                                                                                                                                                                                                                                Function 00452D36 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _doexit.LIBCMT ref: 00452D42
                                                                                                                                                                                                                                  • Part of subcall function 00452C0A: __lock.LIBCMT ref: 00452C18
                                                                                                                                                                                                                                  • Part of subcall function 00452C0A: __decode_pointer.LIBCMT ref: 00452C4F
                                                                                                                                                                                                                                  • Part of subcall function 00452C0A: __decode_pointer.LIBCMT ref: 00452C64
                                                                                                                                                                                                                                  • Part of subcall function 00452C0A: __decode_pointer.LIBCMT ref: 00452C8E
                                                                                                                                                                                                                                  • Part of subcall function 00452C0A: __decode_pointer.LIBCMT ref: 00452CA4
                                                                                                                                                                                                                                  • Part of subcall function 00452C0A: __decode_pointer.LIBCMT ref: 00452CB1
                                                                                                                                                                                                                                  • Part of subcall function 00452C0A: __initterm.LIBCMT ref: 00452CE0
                                                                                                                                                                                                                                  • Part of subcall function 00452C0A: __initterm.LIBCMT ref: 00452CF0
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __decode_pointer$__initterm$__lock_doexit
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1597249276-0
                                                                                                                                                                                                                                • Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                                                                                • Instruction ID: 8d6bd7f476d9df435554fe4cb326262024e670cb76283e6bb3038c31b2a3af3b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EBB0927258020833DA212542AC03F0A3A0A87C1B64E250022BA0C192A2A9A2A9658089
                                                                                                                                                                                                                                Function 00404E20 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • RtlEnterCriticalSection.NTDLL(?), ref: 00404E28
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CriticalEnterSection
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1904992153-0
                                                                                                                                                                                                                                • Opcode ID: b9c7dd88a6a2f43980a2148a92505c3e265fe1e2fe6bca0aa1a842a885cd807d
                                                                                                                                                                                                                                • Instruction ID: 5d27916a456c276c6790515879e2fd678a5b8e0f8b5490b2ab991f798093e1de
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b9c7dd88a6a2f43980a2148a92505c3e265fe1e2fe6bca0aa1a842a885cd807d
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 37B0127510024057E200871CCC08F0A7354FB50709F004830F006E2610C134D890C518

                                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                                Function 004593E0 Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ___getlocaleinfo
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1937885557-0
                                                                                                                                                                                                                                • Opcode ID: 059b32ba138b8bcbd792e0441a0b88036e89a5c540216f72ece7ad7ddfab8594
                                                                                                                                                                                                                                • Instruction ID: 6dac5af7e1b37d42a80d7c205b72975625ada61e9c658b761d4759cc4cc77083
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 059b32ba138b8bcbd792e0441a0b88036e89a5c540216f72ece7ad7ddfab8594
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4EE1DFB2D4021DFEEB11DAE1CD41DFF77BEEF04748F04056AB615E2041EA74AA099764
                                                                                                                                                                                                                                Function 00428420 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 220COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked_memset
                                                                                                                                                                                                                                • String ID: %s\%s$%s\*.*$.
                                                                                                                                                                                                                                • API String ID: 4153837582-1471744235
                                                                                                                                                                                                                                • Opcode ID: 6fcca26c4a8db54827c820d4df1e252df7532c154811494e43a0fecf671746a5
                                                                                                                                                                                                                                • Instruction ID: 26e0967a7780e92016beae03d77b108d88bf0a8648a0e5d26c0d303306081c95
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6fcca26c4a8db54827c820d4df1e252df7532c154811494e43a0fecf671746a5
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1981D6B1609350AED730DF25D885BAF73E4EF98304F84492EE28983251EF789944CB5E
                                                                                                                                                                                                                                Function 00429BF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 95stringfileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • FindClose.KERNEL32(?,?,?,00000000,004284F0,?,?,429E9C66,00474B04,?,?,00000000), ref: 00429C0D
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,00000000,004284F0,?,?,429E9C66,00474B04,?,?,00000000), ref: 00429C2B
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,429E9C66,00474B04,?,?,00000000), ref: 00429C35
                                                                                                                                                                                                                                • lstrcpyW.KERNEL32(?,?), ref: 00429C43
                                                                                                                                                                                                                                • FindFirstFileW.KERNEL32(?,?,?,?,429E9C66,00474B04,?,?,00000000), ref: 00429C4B
                                                                                                                                                                                                                                • GetFullPathNameW.KERNEL32(?,00000104,?,00000000,?,?,429E9C66,00474B04,?,?,00000000), ref: 00429C6A
                                                                                                                                                                                                                                • FindClose.KERNEL32(?,?,?,429E9C66,00474B04,?,?,00000000), ref: 00429C8A
                                                                                                                                                                                                                                • SetLastError.KERNEL32(0000007B,?,?,429E9C66,00474B04,?,?,00000000), ref: 00429C98
                                                                                                                                                                                                                                • _wcsrchr.LIBCMT ref: 00429CA7
                                                                                                                                                                                                                                • _wcsrchr.LIBCMT ref: 00429CB1
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Find$Close_wcsrchrlstrlen$ErrorFileFirstFullLastNamePathlstrcpy
                                                                                                                                                                                                                                • String ID: *.*
                                                                                                                                                                                                                                • API String ID: 1182268193-438819550
                                                                                                                                                                                                                                • Opcode ID: 21f7d67fbdfe4e2fc72a7b5e3b4d7c904d0ae3f92e898dee13d140b0e935993b
                                                                                                                                                                                                                                • Instruction ID: 91888dcaa425c4d073cafd95006dae072c76288eec2690e9b2258728f60debfb
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 21f7d67fbdfe4e2fc72a7b5e3b4d7c904d0ae3f92e898dee13d140b0e935993b
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7A21D2F17007184BD7205FBAADC4A67B7D8EF55316F500D3FE21AC6291D379A8858A1C
                                                                                                                                                                                                                                Function 004058A0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 343COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 00406BB0: InterlockedDecrement.KERNEL32(?), ref: 00406C54
                                                                                                                                                                                                                                • GetUserDefaultUILanguage.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,0046F830,000000FF,00405F68), ref: 00405932
                                                                                                                                                                                                                                  • Part of subcall function 004053E0: InterlockedDecrement.KERNEL32(?), ref: 0040545B
                                                                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 004059FF
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00405CC3
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$DefaultLanguageUser__wcsicoll
                                                                                                                                                                                                                                • String ID: lang_code$languages
                                                                                                                                                                                                                                • API String ID: 1829777147-2788879529
                                                                                                                                                                                                                                • Opcode ID: 20c207669f44bad4e8e8023d082e1b49aaeaf8ec6683a9f7d38b190ce7368d6f
                                                                                                                                                                                                                                • Instruction ID: df69b3d3a442c0349919b480ef91f27c163689c3b1dd665463c607f4da6d87a5
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 20c207669f44bad4e8e8023d082e1b49aaeaf8ec6683a9f7d38b190ce7368d6f
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F2C1EF726047408BC718DF69C98165FB7E1EB84318F494A3EF986A7391D738ED04CB9A
                                                                                                                                                                                                                                Function 00445F90 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 114fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 00445FC9
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __FF_MSGBANNER.LIBCMT ref: 00450A95
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __NMSG_WRITE.LIBCMT ref: 00450A9C
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C,00457324), ref: 00450AE9
                                                                                                                                                                                                                                • SetLastError.KERNEL32(00000008,0044C867,?,?,?,?,00445E34,00000000,00002000,00443071,?,?,?,0044353E,?,?), ref: 00445FD9
                                                                                                                                                                                                                                • CreateFileA.KERNEL32(00000000,00000000,00000003,00000000,00000003,00000080,00000000,00000000,00002000,0044C867,?,?,?,?,00445E34,00000000), ref: 00446020
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044604A
                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,00000000,00002800,?,00000000), ref: 0044606B
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00445E34,00000000,00002000,00443071), ref: 0044609A
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AllocateCloseControlCreateDeviceErrorFileHandleHeapLast_malloc_memset
                                                                                                                                                                                                                                • String ID: DISKID:$\\.\PhysicalDrive%d
                                                                                                                                                                                                                                • API String ID: 2839847783-3765948602
                                                                                                                                                                                                                                • Opcode ID: 5cc655071c0b1365d25c700cfed59a0051602e5a186a31012ebcbc45244836d1
                                                                                                                                                                                                                                • Instruction ID: a1de92b2ab29b175fc6f153e9517009f307cc051edb96b70189ee62439469bd0
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5cc655071c0b1365d25c700cfed59a0051602e5a186a31012ebcbc45244836d1
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 80310A716043046FE310DF29EC42F2F77E8EB85758F544A2EF549822D1DA38E948875B
                                                                                                                                                                                                                                Function 00447E70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 79memorythreadCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00447E7A
                                                                                                                                                                                                                                • OpenThread.KERNEL32(00000040,00000001,-00000008,00000000,?,?,?,?,?,?,?,00447DD0,?,00444638,00000000,00000000), ref: 00447ED5
                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,00447DD0,?,00444638,00000000,00000000,00000CCC,00000040), ref: 00447EDB
                                                                                                                                                                                                                                • GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00447DD0,?,00444638,00000000,00000000,00000CCC,00000040), ref: 00447F0A
                                                                                                                                                                                                                                • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00447DD0,?,00444638,00000000,00000000,00000CCC), ref: 00447F14
                                                                                                                                                                                                                                • OutputDebugStringW.KERNEL32(****** ,?,?,?,?,?,?,?,00447DD0,?,00444638,00000000,00000000,00000CCC,00000040), ref: 00447F21
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00447DD0,?,00444638,00000000,00000000,00000CCC,00000040), ref: 00447F2A
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: HeapThread$CloseCurrentDebugErrorFreeHandleLastOpenOutputProcessString
                                                                                                                                                                                                                                • String ID: ******
                                                                                                                                                                                                                                • API String ID: 2450575844-1974978773
                                                                                                                                                                                                                                • Opcode ID: 9d3e5e4c039345ebe114c5cefb574406e7338fc264cbcaebaacb5e3d82da69dc
                                                                                                                                                                                                                                • Instruction ID: 51a51e9c115f828840f95783b8070805ef4922a51c1e58f9b56eef5133b32690
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9d3e5e4c039345ebe114c5cefb574406e7338fc264cbcaebaacb5e3d82da69dc
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7E31BF34608711DFD7108F58DC44B6B77A4AF85342F14497EE9899B350DB38A846CF6A
                                                                                                                                                                                                                                Function 0044AAD0 Relevance: 10.8, APIs: 7, Instructions: 253processCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 0044AB5F
                                                                                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0044AB68
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044ABB4
                                                                                                                                                                                                                                • Process32FirstW.KERNEL32 ref: 0044ABCA
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044ACBA
                                                                                                                                                                                                                                • Process32NextW.KERNEL32(00000000,0000022C), ref: 0044ACFB
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0044AD09
                                                                                                                                                                                                                                  • Part of subcall function 0040C530: __CxxThrowException@8.LIBCMT ref: 0040C522
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Process32_memset$CloseCountCreateException@8FirstHandleNextSnapshotThrowTickToolhelp32
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 4008832499-0
                                                                                                                                                                                                                                • Opcode ID: a8b5ed3b46d4dc4311dd2404aeff9d35b3ade932b4c224b0812a73572f4d8672
                                                                                                                                                                                                                                • Instruction ID: 0f6d3a8ff6971416350717c0b8073d35420eef7c9a73beb4c9944b75461a59b8
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a8b5ed3b46d4dc4311dd2404aeff9d35b3ade932b4c224b0812a73572f4d8672
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 95A1A2B16043018FD314DF29C889A5BF7E5EF88714F148A2EF865873A1DB34E845CB9A
                                                                                                                                                                                                                                Function 0044DEF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042BA20: _vswprintf_s.LIBCMT ref: 0042BA53
                                                                                                                                                                                                                                • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 0044DF72
                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32 ref: 0044DFB8
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0044DFC3
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044E038
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0044E0B3
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CloseHandle$ControlCreateDeviceFile_memset_vswprintf_s
                                                                                                                                                                                                                                • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                                                                • API String ID: 759969516-2935326385
                                                                                                                                                                                                                                • Opcode ID: e9e87c397d0a192ee5925acba625f21e4647082b7da449d7bf415528d7b84a13
                                                                                                                                                                                                                                • Instruction ID: a15e23ea7357eb51f1a3c456f55b84a775cfad3c4e4a1aff5e10b51883dc3b1d
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e9e87c397d0a192ee5925acba625f21e4647082b7da449d7bf415528d7b84a13
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7D5190B0508340AFE370DF29CC41BAB77E8FB88709F40492EF599D6281E77895458B5B
                                                                                                                                                                                                                                Function 0044E2B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042BA20: _vswprintf_s.LIBCMT ref: 0042BA53
                                                                                                                                                                                                                                • CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,?,0044EE4B,?,00000064), ref: 0044E325
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044E35A
                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00002710,?,00000000), ref: 0044E382
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044E39A
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0044E3E8
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$CloseControlCreateDeviceFileHandle_vswprintf_s
                                                                                                                                                                                                                                • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                                                                • API String ID: 3752575622-2935326385
                                                                                                                                                                                                                                • Opcode ID: 9387e91ae6ce142f3cb9b7e9c60ced8740e0e69b91c4c6284711a193269b59ee
                                                                                                                                                                                                                                • Instruction ID: c9089f54c2234c06cc667325305ac5f1e0a56a652b86bdb3697a1b9bd84c978b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9387e91ae6ce142f3cb9b7e9c60ced8740e0e69b91c4c6284711a193269b59ee
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 89416E71514340ABE324DF6ACC86EAFB3E8FBC9714F400E2EB94882191E77496448B66
                                                                                                                                                                                                                                Function 0044E440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0044DCD0: _vswprintf_s.LIBCMT ref: 0044DD03
                                                                                                                                                                                                                                • CreateFileA.KERNEL32(?,C0000000,00000007,00000000,00000003,00000000,00000000,?,0044D075,?,?), ref: 0044E4A2
                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32 ref: 0044E4EC
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0044E4FB
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __FF_MSGBANNER.LIBCMT ref: 00450A95
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __NMSG_WRITE.LIBCMT ref: 00450A9C
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C,00457324), ref: 00450AE9
                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32 ref: 0044E527
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0044E572
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ControlDevice$AllocateCloseCreateFileHandleHeap_malloc_vswprintf_s
                                                                                                                                                                                                                                • String ID: \\.\PhysicalDrive%d
                                                                                                                                                                                                                                • API String ID: 15615210-2935326385
                                                                                                                                                                                                                                • Opcode ID: 244c69ca2bf85b48f7fd76c954e74568fe78b58d62cb8a18bfde4d741f8a8215
                                                                                                                                                                                                                                • Instruction ID: 2e9a5e26c55d1336204a66ee7600b4eafec7d2229efc62c6f20bcd3bfc96b379
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 244c69ca2bf85b48f7fd76c954e74568fe78b58d62cb8a18bfde4d741f8a8215
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EA31A2B0604300AEF360DF659C85F6BB6E8FB98718F40492DF699D62C0E7B4D5448B5A
                                                                                                                                                                                                                                Function 00445FF9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 00444160: _vswprintf_s.LIBCMT ref: 0044418C
                                                                                                                                                                                                                                • CreateFileA.KERNEL32(00000000,00000000,00000003,00000000,00000003,00000080,00000000,00000000,00002000,0044C867,?,?,?,?,00445E34,00000000), ref: 00446020
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044604A
                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,00000000,00002800,?,00000000), ref: 0044606B
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00445E34,00000000,00002000,00443071), ref: 0044609A
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CloseControlCreateDeviceFileHandle_memset_vswprintf_s
                                                                                                                                                                                                                                • String ID: DISKID:$\\.\PhysicalDrive%d
                                                                                                                                                                                                                                • API String ID: 2627556037-3765948602
                                                                                                                                                                                                                                • Opcode ID: bf4c35fa9a86157aeae70113c38d7515167f41a56530b43b8726da2c379f5ddc
                                                                                                                                                                                                                                • Instruction ID: 077508c17fcc8c822839530485291919e9d0afcfead952c9709067be48ecd5db
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bf4c35fa9a86157aeae70113c38d7515167f41a56530b43b8726da2c379f5ddc
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0511C3B1604300AFE310DF25EC46F2B77E8EB84748F54092EF94996291D638A95887AB
                                                                                                                                                                                                                                Function 0044FBBA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • IsDebuggerPresent.KERNEL32 ref: 00456A27
                                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00456A3C
                                                                                                                                                                                                                                • UnhandledExceptionFilter.KERNEL32(H), ref: 00456A47
                                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(C0000409), ref: 00456A63
                                                                                                                                                                                                                                • TerminateProcess.KERNEL32(00000000), ref: 00456A6A
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                                                                                                • String ID: H
                                                                                                                                                                                                                                • API String ID: 2579439406-37590417
                                                                                                                                                                                                                                • Opcode ID: e986aa3077eee0f0a6d395df6f12edf315826f24537d0dfb7b05155d20a269bb
                                                                                                                                                                                                                                • Instruction ID: f26624073afa94876f617bdbb73aaf8c02ca9b855ca9e049e76bdb464fbeaa4c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e986aa3077eee0f0a6d395df6f12edf315826f24537d0dfb7b05155d20a269bb
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9121BAB4900305AFD750DF6AF889A483BA4FB08745F90497EFD0887662E7B499858F0D
                                                                                                                                                                                                                                Function 00428190 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 104COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004281CF
                                                                                                                                                                                                                                • GetLogicalDriveStringsW.KERNEL32(000000C7,?,?,?,?), ref: 004281E4
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00428218
                                                                                                                                                                                                                                • QueryDosDeviceW.KERNEL32(?,?,00000104,00000000,?,00000000,?,?,?,?), ref: 0042825A
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$DeviceDriveLogicalQueryStrings
                                                                                                                                                                                                                                • String ID: %s\%s
                                                                                                                                                                                                                                • API String ID: 2154659820-4073750446
                                                                                                                                                                                                                                • Opcode ID: 64f9293e1570678257f9a5968778b74c3ed6a6493ebe4354343d7da39f299136
                                                                                                                                                                                                                                • Instruction ID: 641489cb587313ea2822045e1206932fe4f4a65290a5547c9122f258da7225b0
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 64f9293e1570678257f9a5968778b74c3ed6a6493ebe4354343d7da39f299136
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3731D531614341DBD724DF64E841AAB73E8FF98304F44492EE58987240FB74DA48C79B
                                                                                                                                                                                                                                Function 00458457 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 00458463
                                                                                                                                                                                                                                  • Part of subcall function 00456D76: __getptd_noexit.LIBCMT ref: 00456D79
                                                                                                                                                                                                                                  • Part of subcall function 00456D76: __amsg_exit.LIBCMT ref: 00456D86
                                                                                                                                                                                                                                • __amsg_exit.LIBCMT ref: 00458483
                                                                                                                                                                                                                                • __lock.LIBCMT ref: 00458493
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004584B0
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(006C0FE8), ref: 004584DB
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 4271482742-0
                                                                                                                                                                                                                                • Opcode ID: 5070402a107ab572876437a64ffebe64bf23dfd755634f73c15c91a7c0be92be
                                                                                                                                                                                                                                • Instruction ID: f45c0c8ca62d4d46a2ae03e1e205c51423c0e8a37127006e6c91a100db93f855
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5070402a107ab572876437a64ffebe64bf23dfd755634f73c15c91a7c0be92be
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0201E131900A22ABC720BB15980534E7BB0AB01726F10451FEC14B7392EF2C9889CBCE
                                                                                                                                                                                                                                Function 00428300 Relevance: 4.6, APIs: 3, Instructions: 58COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00428331
                                                                                                                                                                                                                                • __wsplitpath.LIBCMT ref: 0042833F
                                                                                                                                                                                                                                  • Part of subcall function 00453398: __wsplitpath_helper.LIBCMT ref: 004533DA
                                                                                                                                                                                                                                • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00428373
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DiskFreeSpace__wsplitpath__wsplitpath_helper_memset
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1401654830-0
                                                                                                                                                                                                                                • Opcode ID: 764ebe6f588dc67b8b060cae33e4ea8493f58f2bc7cfd65e61937c03e1e1b097
                                                                                                                                                                                                                                • Instruction ID: 36cac1ec9178768ce9abd3c5f00dc27ad2aab26b8b1df5e8c7b5db9029a6f1d4
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 764ebe6f588dc67b8b060cae33e4ea8493f58f2bc7cfd65e61937c03e1e1b097
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DB111FB25183419FD314DF55C8D596FF7E9BB8C304F844A2EB49D96240E738A608CB56
                                                                                                                                                                                                                                Function 004460F0 Relevance: 4.6, APIs: 3, Instructions: 52fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • CreateFileA.KERNEL32 ref: 00446118
                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,00170002,00000001,00000004,00000001,00000008,00000080,00000000), ref: 00446149
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0044615C
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 33631002-0
                                                                                                                                                                                                                                • Opcode ID: f98a16de18f5898c596dc0243fbce79f111fe3fcaecf5313bdce5edd5b37d566
                                                                                                                                                                                                                                • Instruction ID: a4e9c9e3475b47f9d99841fc099cd4a62b7c97b39662de1b7d4ecce7ecf77d2f
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f98a16de18f5898c596dc0243fbce79f111fe3fcaecf5313bdce5edd5b37d566
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6001B575604350AFE310DF2ADC45FABB6ECEBC4B10F404A1DFAA492291D3749549C7A6
                                                                                                                                                                                                                                Function 0044AA70 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Version_memset
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 963298953-0
                                                                                                                                                                                                                                • Opcode ID: 21aa7dd16f490637b407389da057b823457bdf48afc26b45154129577a6c1fd1
                                                                                                                                                                                                                                • Instruction ID: 50534b26274eea3b5f7b0de752f08771180913c3cff144351d6576fb86ee086d
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 21aa7dd16f490637b407389da057b823457bdf48afc26b45154129577a6c1fd1
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 20E06D709142489BE328EB24ED17BDA73E4AB44B04F80482CB68987190EA7495488A97
                                                                                                                                                                                                                                Function 0046080C Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(Function_000607CA), ref: 00460811
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3192549508-0
                                                                                                                                                                                                                                • Opcode ID: 18707b74739e5009ffbd270962d3f237f9e5ac48e000dab3cf882551e0fdc41e
                                                                                                                                                                                                                                • Instruction ID: 49a7094a52624204411ffb3022477fc6944f7420c88d015e7eb7171e508a0283
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 18707b74739e5009ffbd270962d3f237f9e5ac48e000dab3cf882551e0fdc41e
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 079002E02525005A47502774AC0A90626909A4CF1779505656105C8464EA945080591A
                                                                                                                                                                                                                                Function 0044EA60 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _vswprintf_s
                                                                                                                                                                                                                                • String ID: %s:%08x
                                                                                                                                                                                                                                • API String ID: 677850445-2617829732
                                                                                                                                                                                                                                • Opcode ID: 4ea3776fa8a76d3911e012c5ba15531579e2dab64e9b9a1b1171b838a91b9a05
                                                                                                                                                                                                                                • Instruction ID: d88464b518b53f8e2e88b51e34c0c7cbccb2da81a546c82c6288b0ba31c0865d
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4ea3776fa8a76d3911e012c5ba15531579e2dab64e9b9a1b1171b838a91b9a05
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0F211DB2D14259AFDB14CFA9D941AEEBBF5FF48710F10822EE419E7340E6349900CB94
                                                                                                                                                                                                                                Function 0042CBA0 Relevance: 43.9, APIs: 29, Instructions: 414COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CBC5
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CBF2
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CC1F
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CC4C
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CC79
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CCA3
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CCCA
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CCF1
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CD18
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CD3F
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CD66
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CD8D
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CDB4
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CDDB
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CE02
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CE29
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CE50
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CE77
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CE9E
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CEC5
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CEEC
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CF13
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CF3A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CF61
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CF88
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CFAF
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CFD6
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042CFFD
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042D024
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3448037634-0
                                                                                                                                                                                                                                • Opcode ID: 1858bf39751783d92e62bc787a9e03434ccd8fc9567310a29f98b275b1dd8405
                                                                                                                                                                                                                                • Instruction ID: fa65a74df9f3bb201e74ce9cb1360e7d461e0f2e83dedac8760d757496eb0fbb
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1858bf39751783d92e62bc787a9e03434ccd8fc9567310a29f98b275b1dd8405
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6BD1E8E2A01E064FD610F63DDCCAE2FB3B9EF507143548B19E42687796EB38E8098755
                                                                                                                                                                                                                                Function 00448560 Relevance: 40.7, APIs: 8, Strings: 15, Instructions: 466processCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00448917
                                                                                                                                                                                                                                • _wcsnlen.LIBCMT ref: 004489FD
                                                                                                                                                                                                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00448A4C
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,429E9C66,00000007,00000008), ref: 00448A63
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,429E9C66,00000007,00000008), ref: 00448A6E
                                                                                                                                                                                                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 00448B4C
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,429E9C66,00000007,00000008), ref: 00448B63
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,429E9C66,00000007,00000008), ref: 00448B6E
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CloseHandle$CreateProcess$_memset_wcsnlen
                                                                                                                                                                                                                                • String ID: "$"%s"$%s %s$360browser.exe$360chrome.exe$360se.exe$`H$`H$browser.exe$chrome.exe$firefox.exe$iexplore.exe$launcher.exe$launchwinapp.exe$open
                                                                                                                                                                                                                                • API String ID: 153734459-3110628964
                                                                                                                                                                                                                                • Opcode ID: da096650cebfc5fe69afeaba7fe617f2de8765c7758c9fc9beb49389b20902b6
                                                                                                                                                                                                                                • Instruction ID: 41433265167646fed769b64203c08f9dd5d4aec0e31c6c5f3a9c46bd43bc31ba
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: da096650cebfc5fe69afeaba7fe617f2de8765c7758c9fc9beb49389b20902b6
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BBF1AD715083418FE320EF65C882B5FB7E5AF84304F54892FF58997291DB38E949CB6A
                                                                                                                                                                                                                                Function 00401030 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 488stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(?), ref: 004010A1
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,429E9C66), ref: 004010B8
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00401134
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00401215
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00401353
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00401375
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$Incrementlstrlen
                                                                                                                                                                                                                                • String ID: %s%s$%s&%s=%s$http$http://$https://
                                                                                                                                                                                                                                • API String ID: 1461404603-775375718
                                                                                                                                                                                                                                • Opcode ID: 275944e11401aeec524d3ccef7b7b44f3e27bc7ed98de4b6c6f94ca755ef9d57
                                                                                                                                                                                                                                • Instruction ID: 32a4df113e374d45fde145aa7ce68bd08e292ee80c76ea9625626b54a407fca7
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 275944e11401aeec524d3ccef7b7b44f3e27bc7ed98de4b6c6f94ca755ef9d57
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9512A1B19093818BD710DB29C845B5FB7E4BF94304F04493EF585AB2A1E738E909CB9B
                                                                                                                                                                                                                                Function 0042BC70 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 411stringsynchronizationCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _wcsrchr.LIBCMT ref: 0042BD56
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988,00477988,?,?,?,?), ref: 0042BE03
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042BE2D
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042BE61
                                                                                                                                                                                                                                  • Part of subcall function 00428850: __wcsupr.LIBCMT ref: 004288C9
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00000000), ref: 0042BECF
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0042BEEC
                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 0042BF17
                                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000003E8), ref: 0042BF3E
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042BF5E
                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 0042BF82
                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 0042BFAB
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042C080
                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 0042C0CD
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042C0F1
                                                                                                                                                                                                                                • __aulldiv.LIBCMT ref: 0042C13B
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CountTick$_memsetlstrlen$DecrementInterlocked$ObjectSingleWait__aulldiv__wcsupr_wcsrchr
                                                                                                                                                                                                                                • String ID: %s_%d%s$02a8342074eb25c8adb2d135e2bab7e5$360TS_Setup_For_Mini.cab
                                                                                                                                                                                                                                • API String ID: 2081219588-1879620780
                                                                                                                                                                                                                                • Opcode ID: 75e96aaf188e61c0e3d203aa0f054fdd3f71df01eed2c4cfda421ede6faf70f1
                                                                                                                                                                                                                                • Instruction ID: bf8ea8c84532d54b9eb3036ebf8e3a2a11d664112a6b331eddf6cd2b412f79bf
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 75e96aaf188e61c0e3d203aa0f054fdd3f71df01eed2c4cfda421ede6faf70f1
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 51F1D070604341CBD724DF68D885B6BB3E5FF88308F544A1EE8888B391D738E945CB9A
                                                                                                                                                                                                                                Function 00417240 Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 276COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042C330: InterlockedIncrement.KERNEL32(00000000), ref: 0042C34C
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004172C1
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00417463
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041748C
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041752E
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00417550
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00417590
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004175B9
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004175E2
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$Increment
                                                                                                                                                                                                                                • String ID: /%s$ /%s:%s$ /promo:$/c:%s /pmode:%s /s$101$channel$clientid$pmode$promo$show
                                                                                                                                                                                                                                • API String ID: 2574743344-2289044305
                                                                                                                                                                                                                                • Opcode ID: bd2f459aa3dd24a74309f835d589f408a88786f3b56a59bee8121492f2dc11ee
                                                                                                                                                                                                                                • Instruction ID: a9fe2e864a18146931104fa66c3393e4ff9a86d1cd4b750448ab0065d79e6878
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bd2f459aa3dd24a74309f835d589f408a88786f3b56a59bee8121492f2dc11ee
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BDA1D6B15083449FD310EB29DC46B9FB3E4AF84318F048A2EF45997292D77CE949C75A
                                                                                                                                                                                                                                Function 004272F0 Relevance: 31.7, APIs: 3, Strings: 15, Instructions: 216libraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(Kernel32.dll,AddDllDirectory,00403B5A), ref: 00427303
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 0042730A
                                                                                                                                                                                                                                  • Part of subcall function 00427590: GetProcAddress.KERNEL32(00000000,GdiplusStartup), ref: 00427596
                                                                                                                                                                                                                                  • Part of subcall function 004275B0: GetProcAddress.KERNEL32(00000000,GdiplusShutdown), ref: 004275B6
                                                                                                                                                                                                                                  • Part of subcall function 004275D0: GetProcAddress.KERNEL32(0000000C,GdipCreateFromHDC), ref: 004275D6
                                                                                                                                                                                                                                  • Part of subcall function 004275F0: GetProcAddress.KERNEL32(00000000,GdipDeleteGraphics), ref: 004275F6
                                                                                                                                                                                                                                  • Part of subcall function 00427610: GetProcAddress.KERNEL32(00000000,GdipCreateSolidFill), ref: 00427616
                                                                                                                                                                                                                                  • Part of subcall function 00427630: GetProcAddress.KERNEL32(00000018,GdipDeleteBrush), ref: 00427636
                                                                                                                                                                                                                                  • Part of subcall function 00427650: GetProcAddress.KERNEL32(00000000,GdipCloneBrush), ref: 00427656
                                                                                                                                                                                                                                  • Part of subcall function 00427670: GetProcAddress.KERNEL32(00000000,GdipAlloc), ref: 00427676
                                                                                                                                                                                                                                  • Part of subcall function 00427690: GetProcAddress.KERNEL32(00000024,GdipFree), ref: 00427696
                                                                                                                                                                                                                                  • Part of subcall function 004276B0: GetProcAddress.KERNEL32(00000000,GdipFillRectangleI), ref: 004276B6
                                                                                                                                                                                                                                  • Part of subcall function 0042C8E0: GetProcAddress.KERNEL32(?,GdipLoadImageFromFile), ref: 0042C8E2
                                                                                                                                                                                                                                  • Part of subcall function 004276D0: GetProcAddress.KERNEL32(00000000,GdipDisposeImage), ref: 004276D6
                                                                                                                                                                                                                                  • Part of subcall function 004276F0: GetProcAddress.KERNEL32(00000000,GdipCloneImage), ref: 004276F6
                                                                                                                                                                                                                                  • Part of subcall function 00427710: GetProcAddress.KERNEL32(00000000,GdipDrawImageI), ref: 00427716
                                                                                                                                                                                                                                  • Part of subcall function 00427730: GetProcAddress.KERNEL32(00000048,GdipDrawImagePointRectI), ref: 00427736
                                                                                                                                                                                                                                  • Part of subcall function 00427750: GetProcAddress.KERNEL32(00000000,GdipDrawImageRectRectI), ref: 00427756
                                                                                                                                                                                                                                  • Part of subcall function 00427770: GetProcAddress.KERNEL32(00000060,GdipDeleteFont), ref: 00427776
                                                                                                                                                                                                                                  • Part of subcall function 00427790: GetProcAddress.KERNEL32(00000000,GdipDeleteFontFamily), ref: 00427796
                                                                                                                                                                                                                                  • Part of subcall function 004277B0: GetProcAddress.KERNEL32(00000000,GdipDeleteStringFormat), ref: 004277B6
                                                                                                                                                                                                                                  • Part of subcall function 004277D0: GetProcAddress.KERNEL32(0000006C,GdipDrawString), ref: 004277D6
                                                                                                                                                                                                                                  • Part of subcall function 004277F0: GetProcAddress.KERNEL32(00000000,GdipSetStringFormatFlags), ref: 004277F6
                                                                                                                                                                                                                                  • Part of subcall function 00427810: GetProcAddress.KERNEL32(00000000,GdipCreateStringFormat), ref: 00427816
                                                                                                                                                                                                                                  • Part of subcall function 00427830: GetProcAddress.KERNEL32(00000000,GdipCreateFont), ref: 00427836
                                                                                                                                                                                                                                  • Part of subcall function 00427850: GetProcAddress.KERNEL32(00000084,GdipCreateFontFamilyFromName), ref: 00427856
                                                                                                                                                                                                                                  • Part of subcall function 00427870: GetProcAddress.KERNEL32(00000000,GdipMeasureString), ref: 00427876
                                                                                                                                                                                                                                  • Part of subcall function 00427890: GetProcAddress.KERNEL32(00000000,GdipDisposeImageAttributes), ref: 00427896
                                                                                                                                                                                                                                  • Part of subcall function 004278B0: GetProcAddress.KERNEL32(00000090,GdipSetImageAttributesColorMatrix), ref: 004278B6
                                                                                                                                                                                                                                  • Part of subcall function 004278D0: GetProcAddress.KERNEL32(00000000,GdipCreateImageAttributes), ref: 004278D6
                                                                                                                                                                                                                                  • Part of subcall function 004278F0: GetProcAddress.KERNEL32(00000000,GdipRotateWorldTransform), ref: 004278F6
                                                                                                                                                                                                                                  • Part of subcall function 00427910: GetProcAddress.KERNEL32(00000000,GdipTranslateWorldTransform), ref: 00427916
                                                                                                                                                                                                                                  • Part of subcall function 00427930: GetProcAddress.KERNEL32(000000A8,GdipDrawImageRectRect), ref: 00427936
                                                                                                                                                                                                                                  • Part of subcall function 00427950: GetProcAddress.KERNEL32(00000000,GdipCreateBitmapFromHBITMAP), ref: 00427956
                                                                                                                                                                                                                                • LoadLibraryExW.KERNEL32(Gdiplus.dll,00000000,-00000800,00403B5A), ref: 00427334
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AddressProc$HandleLibraryLoadModule
                                                                                                                                                                                                                                • String ID: AddDllDirectory$GdipCreateBitmapFromFile$GdipCreateBitmapFromFileICM$GdipCreateBitmapFromStream$GdipCreateBitmapFromStreamICM$GdipGetImageHeight$GdipGetImageWidth$GdipLoadImageFromFile$GdipLoadImageFromFileICM$GdipLoadImageFromStream$GdipLoadImageFromStreamICM$GdipSetStringFormatAlign$GdipSetStringFormatLineAlign$Gdiplus.dll$Kernel32.dll
                                                                                                                                                                                                                                • API String ID: 384173800-3425192470
                                                                                                                                                                                                                                • Opcode ID: 1a7221946a3d6293f3cbe51419b8b48bbf8028f0b6f25d08be27484f6442d6c1
                                                                                                                                                                                                                                • Instruction ID: 91b67e9c3f4c9197435a610dd874ce6fa8238146ca3869ac994c9fdff6e49454
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1a7221946a3d6293f3cbe51419b8b48bbf8028f0b6f25d08be27484f6442d6c1
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 25812571210A159FC734EF69D881E96B3E8AF483487908D1EF1DAC7645DB78F904CBA8
                                                                                                                                                                                                                                Function 004026F0 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 186COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00402768
                                                                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 004027CC
                                                                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 004027E2
                                                                                                                                                                                                                                  • Part of subcall function 00450CC8: __wcsicmp_l.LIBCMT ref: 00450D4F
                                                                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 004027F8
                                                                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 0040280E
                                                                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00402824
                                                                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 0040283C
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004028A4
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004028CD
                                                                                                                                                                                                                                  • Part of subcall function 00409F60: InterlockedDecrement.KERNEL32(-000000F4), ref: 00409F71
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004028E4
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __wcsicoll$DecrementInterlocked$__wcsicmp_l
                                                                                                                                                                                                                                • String ID: down.360safe.com$http$int.down.360safe.com$iup.360safe.com$pinst.360.cn$www.360safe.com$www.360totalsecurity.com
                                                                                                                                                                                                                                • API String ID: 1628746749-4095856921
                                                                                                                                                                                                                                • Opcode ID: dab3907310280774901fa3c6e5727bed210cb5768c654eba5a99dca1a5b95a10
                                                                                                                                                                                                                                • Instruction ID: 26977be2f2d7e28a86010d96609ed7f5b280323b6d18085dc09d3feac8ca12e5
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dab3907310280774901fa3c6e5727bed210cb5768c654eba5a99dca1a5b95a10
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 645102766043065BCB04EA29CD49A2B7394EB81759F008B3EFC15E72D1EB78E8088689
                                                                                                                                                                                                                                Function 0041E860 Relevance: 28.5, APIs: 10, Strings: 6, Instructions: 478COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041E8D7
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041E9BF
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041EC1A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041EC96
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041ED29
                                                                                                                                                                                                                                  • Part of subcall function 0041DA50: InterlockedDecrement.KERNEL32(?), ref: 0041DAD2
                                                                                                                                                                                                                                  • Part of subcall function 0041DA50: InterlockedDecrement.KERNEL32(429E9B72), ref: 0041DB49
                                                                                                                                                                                                                                  • Part of subcall function 0041DA50: InterlockedDecrement.KERNEL32(-0000000C), ref: 0041DB72
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: lstrlenW.KERNEL32(?,?,429E9C66,?,00000000,IDS_QUIT,?,0046E828,000000FF,00403E61,?,?,ini_url_win10_tse,?), ref: 00405132
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041EBA9
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedIncrement.KERNEL32(00000000), ref: 00405119
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedDecrement.KERNEL32(-0000000C), ref: 00405155
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041EDCE
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041EE03
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041EE7F
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041EF16
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$Incrementlstrlen
                                                                                                                                                                                                                                • String ID: IDS_BUTTON_REDOWN$IDS_DOWNLOAD_ERR$IDS_ERROR_DOWNFAIL_PROMPT$IDS_ERROR_INSTFAIL$IDS_INSTALL_ERR$IDS_PRODUCT_NAME
                                                                                                                                                                                                                                • API String ID: 1461404603-1716429299
                                                                                                                                                                                                                                • Opcode ID: a78b066669d6b4f6098b0872509e2407d767a9de31d9e3b625f3e265ef9aa851
                                                                                                                                                                                                                                • Instruction ID: 0a5fc1a9864af0b056529969764a3fd6165abc45d977d7fae5e3887258048961
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a78b066669d6b4f6098b0872509e2407d767a9de31d9e3b625f3e265ef9aa851
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1E02F6716047019BD710EF24CC8AB8B73A5EF44714F044A2DFA15AF2D2DBB8A8458B9A
                                                                                                                                                                                                                                Function 00414E70 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 286stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00414EDE
                                                                                                                                                                                                                                  • Part of subcall function 0044EF30: _memset.LIBCMT ref: 0044EF71
                                                                                                                                                                                                                                  • Part of subcall function 0044EF30: _memset.LIBCMT ref: 0044EF8E
                                                                                                                                                                                                                                  • Part of subcall function 0044EF30: lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,0044D075,00000000), ref: 0044EF9D
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988,?,000000C8,0044D075,?,00000000), ref: 00414F2D
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00414F75
                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32 ref: 0041501A
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: LoadStringW.USER32(00400000,00477988,00000100,00000100), ref: 0040D78E
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: lstrlenW.KERNEL32(?,?,?,00477988), ref: 0040D7B5
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988,?,?,?,?,?,00000000,00000110,?,00000000), ref: 00414FCF
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00415100
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00415181
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004151B5
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004151F0
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00415212
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041522F
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$_memsetlstrlen$FileLoadModuleNameString
                                                                                                                                                                                                                                • String ID: %d.%d$&opr_state=%x$101$channel$http://s.360safe.com/360ts/mini_inst.htm?ver=%s&pid=%s&os=%s&mid=%s&state=%d
                                                                                                                                                                                                                                • API String ID: 576141987-2005637560
                                                                                                                                                                                                                                • Opcode ID: f5064faea94a9e67bedeca49c98d842adbc20d780ff97fd3cebd41b20fd993b9
                                                                                                                                                                                                                                • Instruction ID: e622bc9d2f27d639ca4cd9076082fc8319e273e6c2a68465243226f7a8ca597b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f5064faea94a9e67bedeca49c98d842adbc20d780ff97fd3cebd41b20fd993b9
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5EB1C1B15087419FD311DB15DC42BDFB7E8AF84708F444A2EF84897291E738EA488B9A
                                                                                                                                                                                                                                Function 00402370 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 262stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004023C5
                                                                                                                                                                                                                                  • Part of subcall function 0044EF30: _memset.LIBCMT ref: 0044EF71
                                                                                                                                                                                                                                  • Part of subcall function 0044EF30: _memset.LIBCMT ref: 0044EF8E
                                                                                                                                                                                                                                  • Part of subcall function 0044EF30: lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,0044D075,00000000), ref: 0044EF9D
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988,?,000000C8,0044D075,?,00000000), ref: 0040240C
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00402456
                                                                                                                                                                                                                                • __time64.LIBCMT ref: 00402520
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: LoadStringW.USER32(00400000,00477988,00000100,00000100), ref: 0040D78E
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: lstrlenW.KERNEL32(?,?,?,00477988), ref: 0040D7B5
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040257F
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040260F
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040262D
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040264F
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00402678
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004026B3
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$_memset$lstrlen$LoadString__time64
                                                                                                                                                                                                                                • String ID: %d.%d$101$appname$channel$https://orion.ts.360.com/promo/opera?ch=%s&sch=%s&ver=%s&lan=%s&os=%s&mid=%s&mver=%s&time=%I64d${G
                                                                                                                                                                                                                                • API String ID: 183007635-2930611904
                                                                                                                                                                                                                                • Opcode ID: 5a4455248ce1ab45a790e34826156d2cae27c18eb61cf57c8d75fd01ffc1e617
                                                                                                                                                                                                                                • Instruction ID: f321205bbf127581bb2dbb449e3ac44e68e10521bbb042f5124efc082c3a9573
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5a4455248ce1ab45a790e34826156d2cae27c18eb61cf57c8d75fd01ffc1e617
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0D91F9B15047405BD311EB25CC55F9FB3E8AF84708F444A2EF954972D2E778DA08C79A
                                                                                                                                                                                                                                Function 00415410 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 328COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0041562B
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __FF_MSGBANNER.LIBCMT ref: 00450A95
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __NMSG_WRITE.LIBCMT ref: 00450A9C
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C,00457324), ref: 00450AE9
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0041563C
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004157AF
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(00000001), ref: 00415939
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$AllocateDecrementHeapInterlocked_malloc
                                                                                                                                                                                                                                • String ID: &$*$/$316b91494d610d5492487f01$<$C$X$h$i$p$|
                                                                                                                                                                                                                                • API String ID: 1544177133-974832637
                                                                                                                                                                                                                                • Opcode ID: c3ed07719cc60ec7a6689fea899c42ce8952c35bb0c462a4bbda24ff37fca850
                                                                                                                                                                                                                                • Instruction ID: 0eddf6f098313e1fd420fbb9ac995c69b9b94b4753434c4e8a7443bfddef9d66
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c3ed07719cc60ec7a6689fea899c42ce8952c35bb0c462a4bbda24ff37fca850
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 73E165715083C0CFD720DB29C844B9FBBE1ABD6318F444A1EE4D847292D739A949CBA7
                                                                                                                                                                                                                                Function 0041CC80 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 202stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32 ref: 0041CCE2
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?), ref: 0041CCF0
                                                                                                                                                                                                                                  • Part of subcall function 0040E540: InterlockedDecrement.KERNEL32(-0000000C), ref: 0040E55B
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-000000F4), ref: 0041CD7B
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(00000010), ref: 0041CDA4
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041CDD1
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041CE57
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(00000010), ref: 0041CE80
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-000000F4), ref: 0041CEA9
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9B72), ref: 0041CEFC
                                                                                                                                                                                                                                  • Part of subcall function 00411010: lstrlenW.KERNEL32(\liveupdatelog,429E9C66,00000000,00000000,\liveupdatelog,?,0046C8B9,000000FF,0042C659,?,?,00000000,00000000), ref: 00411058
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$lstrlen$FileModuleName
                                                                                                                                                                                                                                • String ID: /runonce$/tsewin10$/tswin10$360Installer.exe$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
                                                                                                                                                                                                                                • API String ID: 2653400381-459420039
                                                                                                                                                                                                                                • Opcode ID: 424e6bf1d7059022c0b36503549f7a1be548c5545040c8aec381a30c613e0b84
                                                                                                                                                                                                                                • Instruction ID: 52d08daff5897639d9f6666cfdb8fe2edd878129c980d6f69e3838c2973b62e4
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 424e6bf1d7059022c0b36503549f7a1be548c5545040c8aec381a30c613e0b84
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C671C3B15087419BC310DB28CC95BAFB7E9EF84314F144B2EF569872D1EB38D948875A
                                                                                                                                                                                                                                Function 0042D100 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 135stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042D040: GetPrivateProfileStringW.KERNEL32(429E9C66,?,0048B918,00000000,004900E4,00000400), ref: 0042D06A
                                                                                                                                                                                                                                  • Part of subcall function 0042D040: lstrlenW.KERNEL32 ref: 0042D07A
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(.exe,.exe,0048B918,Fid,0048B918,Urls,0048B918,Version,0048B918,SlideShowImage,0048B918,Pid,0048B918,Name,429E9C66,004900B8), ref: 0042D1B0
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(004744F4,0048B918,SetupParam,0048B918,MD5FileID,0048B918,Fid,0048B918,Urls,0048B918,Version,0048B918,SlideShowImage,0048B918,Pid,0048B918), ref: 0042D212
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042D281
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: lstrlen$DecrementInterlockedPrivateProfileString
                                                                                                                                                                                                                                • String ID: .exe$360Installer$Fid$IsBeta$MD5FileID$Name$Pid$SetupParam$SlideShowImage$Urls$Version
                                                                                                                                                                                                                                • API String ID: 266956106-2283486364
                                                                                                                                                                                                                                • Opcode ID: a650b64cbe958658ad68ef05c5d5ff97521fd23d5cdbf41d32d9a5c2a8dc41d9
                                                                                                                                                                                                                                • Instruction ID: f892544cd9f61ad5c73214ebd5b74b046fb8dff67859e95e493b1f18e3384b7c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a650b64cbe958658ad68ef05c5d5ff97521fd23d5cdbf41d32d9a5c2a8dc41d9
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9D41A171700611ABC301EB15DC91FABB3A4BB84718F54861BF81597782DB2CFC158BA9
                                                                                                                                                                                                                                Function 00401D40 Relevance: 24.6, APIs: 4, Strings: 10, Instructions: 127stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • lstrlenA.KERNEL32(00000017), ref: 00401E14
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,00000034,000000FF,GPLD,00000001), ref: 00401E4D
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(GPLD), ref: 00401E6C
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-000000DD), ref: 00401EB5
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: lstrlen$ByteCharDecrementInterlockedMultiWide
                                                                                                                                                                                                                                • String ID: !$#$)$-$4$5$<$>$?$GPLD
                                                                                                                                                                                                                                • API String ID: 2012122458-3612252890
                                                                                                                                                                                                                                • Opcode ID: af7150421ce1432735fdcc2c531ae99e6d7ff5ad53e8d56998f74c4617f016b0
                                                                                                                                                                                                                                • Instruction ID: 82320a007b31baecae04ad9355c794eaab8fc69da9144cdaa4b57b73e3a2adca
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: af7150421ce1432735fdcc2c531ae99e6d7ff5ad53e8d56998f74c4617f016b0
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1551397010C3828BD305CF29C844B1FBBE5AB95708F040E2DF4959B292E779DA09C79B
                                                                                                                                                                                                                                Function 00414740 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 91COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _wcsncat$_memset$__wcsnicmp_wcsncpy
                                                                                                                                                                                                                                • String ID: 360$http://down.360safe.com/setup.exe$http://down.360safe.com/setup.exe$http://down.360safe.com/setupbeta.exe$open
                                                                                                                                                                                                                                • API String ID: 3124461487-1228336228
                                                                                                                                                                                                                                • Opcode ID: 8f160fdcf5ffff5785f49317524220fde9427d2bb41dbdf7f44ac74652851f7c
                                                                                                                                                                                                                                • Instruction ID: 9824ab8bf11515c1a67a16df56c3b7829d97fd19184a2b249a2c0dad8fe634e1
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8f160fdcf5ffff5785f49317524220fde9427d2bb41dbdf7f44ac74652851f7c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 96215176A8430076F110B7A19D07F9B37686B54F06F50891FBA88A50C2FEFC950C87AE
                                                                                                                                                                                                                                Function 0042A640 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 148memoryCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • FindResourceW.KERNEL32(00000000,000000CA,PNG,?,00000000,?,?,?,?), ref: 0042A653
                                                                                                                                                                                                                                • SizeofResource.KERNEL32(00000000,00000000), ref: 0042A662
                                                                                                                                                                                                                                • LoadResource.KERNEL32(00000000,00000000), ref: 0042A671
                                                                                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 0042A678
                                                                                                                                                                                                                                • GlobalAlloc.KERNEL32(00000002,00000000), ref: 0042A68B
                                                                                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 0042A698
                                                                                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 0042A6AB
                                                                                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 0042A6B6
                                                                                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 0042A6BD
                                                                                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 0042A6DB
                                                                                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 0042A79E
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Global$Resource$Free$LockUnlock$AllocFindLoadSizeof
                                                                                                                                                                                                                                • String ID: PNG
                                                                                                                                                                                                                                • API String ID: 1526922560-364855578
                                                                                                                                                                                                                                • Opcode ID: d92cbd912011b002f06c50bca26658b6d7c28a59fc095d984fd223c93ebe8a7a
                                                                                                                                                                                                                                • Instruction ID: 353d2a435fc15b5c7337a03fe66b7e337074d0a843b9350d86455e64d8d67a2c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d92cbd912011b002f06c50bca26658b6d7c28a59fc095d984fd223c93ebe8a7a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 034113766003515BC720AF65AC49F4B77A8AF80756F04043AFC0997302EA79D898CBBE
                                                                                                                                                                                                                                Function 0044CDC4 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 68memorylibraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • IsProcessorFeaturePresent.KERNEL32(0000000C,0044CE9A,00000000,0040474E,?,?,00419E8C,?,00418F76,00000000), ref: 0044CDC6
                                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,00000000,?,?,00419E8C,?,00418F76,00000000), ref: 0044CDDF
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,InterlockedPushEntrySList), ref: 0044CDF9
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,InterlockedPopEntrySList), ref: 0044CE06
                                                                                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000008,?,00419E8C,?,00418F76,00000000), ref: 0044CE38
                                                                                                                                                                                                                                • HeapAlloc.KERNEL32(00000000,?,00419E8C,?,00418F76,00000000), ref: 0044CE3B
                                                                                                                                                                                                                                • InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 0044CE51
                                                                                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000000,?,00419E8C,?,00418F76,00000000), ref: 0044CE5E
                                                                                                                                                                                                                                • HeapFree.KERNEL32(00000000,?,00419E8C,?,00418F76,00000000), ref: 0044CE61
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Heap$AddressProcProcess$AllocCompareExchangeFeatureFreeInterlockedLibraryLoadPresentProcessor
                                                                                                                                                                                                                                • String ID: InterlockedPopEntrySList$InterlockedPushEntrySList$kernel32.dll
                                                                                                                                                                                                                                • API String ID: 3830925854-2586642590
                                                                                                                                                                                                                                • Opcode ID: 040018face06146e328cc8c4a2cf847a71e25b0abfccc583f3620ac05ef8c8a0
                                                                                                                                                                                                                                • Instruction ID: c0b0ed730d2b1ccbf64ae9c5a71105cf623ea2ac8f748dbaea05edd9d26aeaa2
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 040018face06146e328cc8c4a2cf847a71e25b0abfccc583f3620ac05ef8c8a0
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1D119875A42241AFE750AF79ECC8E5B3BE8EB49751764483AE109D7360D7348C80CB6C
                                                                                                                                                                                                                                Function 00422080 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 234stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 00422130
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004221AB
                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 004221BF
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00422292
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004222BB
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004222E4
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00422315
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00422386
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$FileModuleName_memsetlstrlen
                                                                                                                                                                                                                                • String ID: .exe$.h2$.h3
                                                                                                                                                                                                                                • API String ID: 542689168-2327015154
                                                                                                                                                                                                                                • Opcode ID: 9aa3eb75b77d5cf560237438c95faeaec6064b1507ac6f7f25d43059fc53617c
                                                                                                                                                                                                                                • Instruction ID: ca3b48babb3af611398691339ec8355976e898115972b1a0232b39d72571322a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9aa3eb75b77d5cf560237438c95faeaec6064b1507ac6f7f25d43059fc53617c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6A9104716087909FD310EB29D885B5FB3E4AF84318F844A2EF89897391D778D909C79A
                                                                                                                                                                                                                                Function 0042D660 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 200stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedIncrement.KERNEL32(00000000), ref: 00405119
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedDecrement.KERNEL32(-0000000C), ref: 00405155
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042D6E9
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042D72F
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?), ref: 0042D785
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?), ref: 0042D79B
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042D7D8
                                                                                                                                                                                                                                • GetLogicalDrives.KERNEL32 ref: 0042D7F7
                                                                                                                                                                                                                                • GetDriveTypeW.KERNEL32(?), ref: 0042D835
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042D8D0
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$lstrlen$DriveDrivesIncrementLogicalType_memset
                                                                                                                                                                                                                                • String ID: 360\360safe$A:\$IDS_SPACE_SIZE
                                                                                                                                                                                                                                • API String ID: 1999863898-2085469910
                                                                                                                                                                                                                                • Opcode ID: 8fe0a34f6668d2c068ee49d1c009f3d53858c84f21c5557191b6d0b71880d497
                                                                                                                                                                                                                                • Instruction ID: eea04994ecd288255ef4bdfd87dedd0b66caed29c8b016166f82c872d728784c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8fe0a34f6668d2c068ee49d1c009f3d53858c84f21c5557191b6d0b71880d497
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9171C371A083508FD310EB29E845A5FB7E4EB84708F444A3EF95897391E738DD48CB9A
                                                                                                                                                                                                                                Function 004127C0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 182stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042C330: InterlockedIncrement.KERNEL32(00000000), ref: 0042C34C
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(429E9C5A), ref: 0041281E
                                                                                                                                                                                                                                  • Part of subcall function 00428420: _memset.LIBCMT ref: 004284C0
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(429E9C66), ref: 00412830
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(.dir,.dir,429E9C66), ref: 00412851
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004128BE
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00412920
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(00000000), ref: 00412966
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004129D8
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004129FB
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$Incrementlstrlen$_memset
                                                                                                                                                                                                                                • String ID: .dir$360Installer$\Setup.ini
                                                                                                                                                                                                                                • API String ID: 3850328484-1230095776
                                                                                                                                                                                                                                • Opcode ID: 8d6060df4f86533c18383ebb05fa17f4d9c3ebf9a9cec09f7465c8022bd22844
                                                                                                                                                                                                                                • Instruction ID: 69b22e282954b531b65fd8cec1e3257e78da90c672635985121b3b12a908c570
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8d6060df4f86533c18383ebb05fa17f4d9c3ebf9a9cec09f7465c8022bd22844
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6961D2B16042859FD700EB29CD85B8FB7E8EF44308F04492EF94897291E778DD49CB9A
                                                                                                                                                                                                                                Function 00416FE0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 155stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042C330: InterlockedIncrement.KERNEL32(00000000), ref: 0042C34C
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(00000000), ref: 0041703D
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 0041704F
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(.dir,.dir,?), ref: 0041706C
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004170DF
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(00000000), ref: 0041713D
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(00000000), ref: 0041716A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00417195
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004171B7
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$Incrementlstrlen
                                                                                                                                                                                                                                • String ID: .dir$360Installer$\Setup.ini
                                                                                                                                                                                                                                • API String ID: 1461404603-1230095776
                                                                                                                                                                                                                                • Opcode ID: 5cdc09f6efc21740770b6f1b8ca3e009dd8ccf046efd72c53f5d337bef6e0193
                                                                                                                                                                                                                                • Instruction ID: 9f3bc4af63d5b15ba64221d21d944b33b996e7e6455e6f8bcb56da77f6787ce5
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5cdc09f6efc21740770b6f1b8ca3e009dd8ccf046efd72c53f5d337bef6e0193
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BA51C0725097419FC300EB25DC41A8FB7E8AF85318F44492EF95493391E73CEE498B9A
                                                                                                                                                                                                                                Function 0044AE40 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 152COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _wcsnlen.LIBCMT ref: 0044AE7F
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044AEA3
                                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(0000008B,?,?,?,?,?,?,?,?,?,00000000), ref: 0044AED9
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044AF84
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$CurrentProcess_wcsnlen
                                                                                                                                                                                                                                • String ID: $S-1-16-8192
                                                                                                                                                                                                                                • API String ID: 79552288-2499305363
                                                                                                                                                                                                                                • Opcode ID: 5128e4b5606d9aa596c3b605e6af5f482f33c65ba2f0cdda7b5ab780ca147c65
                                                                                                                                                                                                                                • Instruction ID: 47eac83c426cc591b99c36042b036e867d07b683d460ca494f288136ac888fa3
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5128e4b5606d9aa596c3b605e6af5f482f33c65ba2f0cdda7b5ab780ca147c65
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 714162B15443406FE320DF29DC85D6FB7E8ABC8701F544E1EF999D3281E634D9488BAA
                                                                                                                                                                                                                                Function 00401FA0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 100libraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Version_memset$AddressHandleModuleProc
                                                                                                                                                                                                                                • String ID: @$CurrentVersion$RtlGetVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
                                                                                                                                                                                                                                • API String ID: 1783837079-3505882767
                                                                                                                                                                                                                                • Opcode ID: 4c18692da32f26a83ade4f431922e1331f43973aa5319018949dc88e7ff18621
                                                                                                                                                                                                                                • Instruction ID: 62c177df723649326183b33e859cfbbd66297ea6d56d6893b8d26ea0d5b64234
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4c18692da32f26a83ade4f431922e1331f43973aa5319018949dc88e7ff18621
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0431E1B19003419BD724DF25CD05BEBB7E4BB88701F00893EE549D62C1D7B8D548CB9A
                                                                                                                                                                                                                                Function 00456C16 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0047EB98,0000000C,00456D51,00000000,00000000,?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C), ref: 00456C28
                                                                                                                                                                                                                                • __crt_waiting_on_module_handle.LIBCMT ref: 00456C33
                                                                                                                                                                                                                                  • Part of subcall function 00452A96: Sleep.KERNEL32(000003E8,?,?,00456B3C,KERNEL32.DLL,?,00456BA8,?,00450807), ref: 00452AA2
                                                                                                                                                                                                                                  • Part of subcall function 00452A96: GetModuleHandleW.KERNEL32(?,?,?,00456B3C,KERNEL32.DLL,?,00456BA8,?,00450807), ref: 00452AAB
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00456C5C
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,DecodePointer), ref: 00456C6C
                                                                                                                                                                                                                                • __lock.LIBCMT ref: 00456C8E
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(004874A0), ref: 00456C9B
                                                                                                                                                                                                                                • __lock.LIBCMT ref: 00456CAF
                                                                                                                                                                                                                                • ___addlocaleref.LIBCMT ref: 00456CCD
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                                                                                                                                                                • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                                                                                                • API String ID: 1028249917-2843748187
                                                                                                                                                                                                                                • Opcode ID: af3db1431a493bd2ba160a39a69c7b99ed40737b36cae45f5304aaaba00f2a04
                                                                                                                                                                                                                                • Instruction ID: 4f1daf4bc606acd59444637b6f32fb098fc80ab9ba53b2efe899b966bd582377
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: af3db1431a493bd2ba160a39a69c7b99ed40737b36cae45f5304aaaba00f2a04
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 991196704007019ED7219F7AD90575ABBF0EF00319F20895FE899973A2D7789989CB1C
                                                                                                                                                                                                                                Function 0042C5B0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 189stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042E3B0: InterlockedDecrement.KERNEL32(?), ref: 0042E40A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9B72), ref: 0042C687
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(\360P2SP.dll,\360P2SP.dll,?,?,00000000,00000000), ref: 0042C6A7
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042C6E2
                                                                                                                                                                                                                                  • Part of subcall function 00411010: lstrlenW.KERNEL32(\liveupdatelog,429E9C66,00000000,00000000,\liveupdatelog,?,0046C8B9,000000FF,0042C659,?,?,00000000,00000000), ref: 00411058
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042C7DB
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$lstrlen
                                                                                                                                                                                                                                • String ID: RemoveTask$StartTask$StopSeed$StopTask$\360P2SP.dll$\liveupdatelog
                                                                                                                                                                                                                                • API String ID: 2495739296-2922537963
                                                                                                                                                                                                                                • Opcode ID: 154d3612b8fe33b0415c62218aebad10731913f047cb8c26cf6a21a02347c24b
                                                                                                                                                                                                                                • Instruction ID: 1a14c9f4fd36bd8ecf7bc5f416fdbc8c6d1f6b4d6f7c8f3d6896e0bfc830d3e6
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 154d3612b8fe33b0415c62218aebad10731913f047cb8c26cf6a21a02347c24b
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BD61A6716001159BD700EF29DC81A9F77A8AF4435CF44892EF80997251E739EE198B9A
                                                                                                                                                                                                                                Function 0045BEC4 Relevance: 16.7, APIs: 11, Instructions: 166COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetStringTypeW.KERNEL32(00000001,00471874,00000001,?,00000002,00000000,-0000009C,?,?,?,0045C0AE,00000001,?,-00000080,?,?), ref: 0045BEF3
                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,0045C0AE,00000001,?,-00000080,?,?,?,?,-00000080,?,00000001,-00000080,-00000080,00000008,?), ref: 0045BF05
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(-00000080,00000000,?,?,00000000,00000000,00000002,00000000,-0000009C,?,?,?,0045C0AE,00000001,?,-00000080), ref: 0045BF6A
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0045BF9F
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0045BFBF
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,-00000080,?,00000001,-00000080,-00000080,00000008,?,-00000080), ref: 0045BFD4
                                                                                                                                                                                                                                • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0045BFE2
                                                                                                                                                                                                                                • __freea.LIBCMT ref: 0045BFEC
                                                                                                                                                                                                                                • ___ansicp.LIBCMT ref: 0045C016
                                                                                                                                                                                                                                • ___convertcp.LIBCMT ref: 0045C037
                                                                                                                                                                                                                                  • Part of subcall function 00462BF5: GetCPInfo.KERNEL32(?,-00000080,?,00000000,00000000,-0000009C,?,?,?,0045C0AE,00000001,?,-00000080,?,?,?), ref: 00462C40
                                                                                                                                                                                                                                  • Part of subcall function 00462BF5: GetCPInfo.KERNEL32(?,00000001,?,0045C0AE,00000001,?), ref: 00462C59
                                                                                                                                                                                                                                  • Part of subcall function 00462BF5: _strlen.LIBCMT ref: 00462C77
                                                                                                                                                                                                                                  • Part of subcall function 00462BF5: _memset.LIBCMT ref: 00462CEF
                                                                                                                                                                                                                                  • Part of subcall function 00462BF5: MultiByteToWideChar.KERNEL32(?,00000001,?,0045C0AE,?,00000000,?,?,?,?,?,?,?,0045C0AE,00000001,?), ref: 00462D06
                                                                                                                                                                                                                                  • Part of subcall function 00462BF5: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,0045C0AE), ref: 00462D21
                                                                                                                                                                                                                                • GetStringTypeA.KERNEL32(?,?,?,?,?,00000002,00000000,-0000009C,?,?,?,0045C0AE,00000001,?,-00000080,?), ref: 0045C057
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ByteCharMultiWide$StringType$Info_memset$ErrorLast___ansicp___convertcp__freea_malloc_strlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 820197566-0
                                                                                                                                                                                                                                • Opcode ID: 9f1358449f46e5ce0c2d20d536fbb803871f3a64f27086c93c883362545355ee
                                                                                                                                                                                                                                • Instruction ID: f205693f9ebe0d3f4d7a1574f00a73fac47424efd1d2393a5efb4e3884dbbae3
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9f1358449f46e5ce0c2d20d536fbb803871f3a64f27086c93c883362545355ee
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FD51817250020AEFDF109FA5DCC19AF7BA9FB04756B10442AFD15D7262D738CD988B98
                                                                                                                                                                                                                                Function 0042A4B0 Relevance: 16.6, APIs: 11, Instructions: 93COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • FindResourceW.KERNEL32(00000000,000003E9,?,?,0042A5BD,?,?), ref: 0042A4BA
                                                                                                                                                                                                                                • SizeofResource.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0042A4CE
                                                                                                                                                                                                                                • LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000080), ref: 0042A4DD
                                                                                                                                                                                                                                • LockResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000080,00000001), ref: 0042A4E4
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Resource$FindLoadLockSizeof
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3473537107-0
                                                                                                                                                                                                                                • Opcode ID: ff92471677e0ea4760fc2d3585c8390f52c11a894cce02b3014b10523cced3f9
                                                                                                                                                                                                                                • Instruction ID: 1dd85fc49d2eb8ecd14fc7e73ae0f00758dd18b23a2c23e6553a2610f87b4701
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ff92471677e0ea4760fc2d3585c8390f52c11a894cce02b3014b10523cced3f9
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A521F776604291ABD320AB79BC4CF7B77ACEB94765F01443AF909D2220D674CCC5867A
                                                                                                                                                                                                                                Function 00418C40 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 135stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 00418C9F
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?), ref: 00418CBA
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418D63
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418D85
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418DB8
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418DDA
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$lstrlen
                                                                                                                                                                                                                                • String ID: IDCANCEL$IDOK$Q<@@
                                                                                                                                                                                                                                • API String ID: 2495739296-590529798
                                                                                                                                                                                                                                • Opcode ID: e1b338dd28241a3b532fd08158bd6f8e9b38996ba765d62ab48a956bfa57043a
                                                                                                                                                                                                                                • Instruction ID: 71317338b3186c1d47cb1ad627db644d2d956988befbdd979e906ac645202898
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e1b338dd28241a3b532fd08158bd6f8e9b38996ba765d62ab48a956bfa57043a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6541F472505B418FC311EB15DC45BDFB3E4AF94318F00492EF94497291EB38AA4ACBDA
                                                                                                                                                                                                                                Function 004032B0 Relevance: 15.2, APIs: 10, Instructions: 181COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetCommandLineW.KERNEL32(429E9C66,?,?,?,?), ref: 004032DF
                                                                                                                                                                                                                                • CommandLineToArgvW.SHELL32 ref: 004032FE
                                                                                                                                                                                                                                • _wcschr.LIBCMT ref: 00403364
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004033BB
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040340D
                                                                                                                                                                                                                                • CharLowerW.USER32(?,00000022), ref: 00403458
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9C5A), ref: 0040348C
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004034AA
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004034CF
                                                                                                                                                                                                                                • LocalFree.KERNEL32(00000000), ref: 004034F6
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$CommandLine$ArgvCharFreeLocalLower_wcschr
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3516251473-0
                                                                                                                                                                                                                                • Opcode ID: b378592a1081cbb3a52536feeb4719324f654035e9580b7883829affbed0aa53
                                                                                                                                                                                                                                • Instruction ID: 5c59bca7be180eac52cac70ab346d7c10931c347901fe7930e37a03049cf4d71
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b378592a1081cbb3a52536feeb4719324f654035e9580b7883829affbed0aa53
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3561F3715083419FC301EF25C885A5FBBE8EF84319F44093EF854A72D2E738EA098B5A
                                                                                                                                                                                                                                Function 0046301F Relevance: 15.2, APIs: 10, Instructions: 173COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __fileno$__cftof__getbuf__wctomb_s_l
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1564009976-0
                                                                                                                                                                                                                                • Opcode ID: 3e1f1c220a331b319fd53200982c08bfd9048f4c94be61eeacb48d671dd4988c
                                                                                                                                                                                                                                • Instruction ID: 542db0e9ec3801c25479eb63e9b7c706cabcf52bd37b5ebe8893eda2a0101063
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3e1f1c220a331b319fd53200982c08bfd9048f4c94be61eeacb48d671dd4988c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F151F532508B059FCB20DF29C841A6A77E0EF1533CB184A6FE4A587691F738E945CB5E
                                                                                                                                                                                                                                Function 00410CB0 Relevance: 15.1, APIs: 10, Instructions: 148stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(?), ref: 00410CF4
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(-000000F4), ref: 00410D39
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00000000,?,?,00000000,?,0046CBAC,000000FF), ref: 00410D55
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(?), ref: 00410D81
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,00000000,?,00000000,?,0046CBAC,000000FF), ref: 00410D9E
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(?), ref: 00410DCA
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,00000000,?,0046CBAC,000000FF), ref: 00410DE7
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(?), ref: 00410E13
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,00000000,?,0046CBAC,000000FF), ref: 00410E2F
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: IncrementInterlocked$lstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 4011519848-0
                                                                                                                                                                                                                                • Opcode ID: 3eb8373b49d7035bb6111456700a3be3f518591fc4f58aa3e5194be97bb28c28
                                                                                                                                                                                                                                • Instruction ID: 4cd4a81fb511b735a1623f50a38cd60bab83780fd8b469a2286672bbcd0ca16f
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3eb8373b49d7035bb6111456700a3be3f518591fc4f58aa3e5194be97bb28c28
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 97519FB0604655EFC700CF69D84879AB7E4FF08318F148A2AE859D7761D778E9C0CB99
                                                                                                                                                                                                                                Function 0041D3F0 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 369COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0041B050: lstrlenW.KERNEL32(?), ref: 0041B0B0
                                                                                                                                                                                                                                  • Part of subcall function 0041B050: InterlockedDecrement.KERNEL32(?), ref: 0041B119
                                                                                                                                                                                                                                  • Part of subcall function 00419EC0: GetCurrentProcess.KERNEL32(00000000,0000000D), ref: 00419EF9
                                                                                                                                                                                                                                  • Part of subcall function 00419EC0: FlushInstructionCache.KERNEL32(00000000), ref: 00419F00
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041D89A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041D8BC
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041D8DE
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041D900
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$CacheCurrentFlushInstructionProcesslstrlen
                                                                                                                                                                                                                                • String ID: IDS_INSTALL$IDS_LICENSE$IDS_POLICY$IDS_REMIND_LATER
                                                                                                                                                                                                                                • API String ID: 1772758866-518933390
                                                                                                                                                                                                                                • Opcode ID: 1fe08fa937d19b55a06be59d94f1e6598942e7b0ac238153ebb95e13baeb4c12
                                                                                                                                                                                                                                • Instruction ID: 305bc1bf7515f1a9c08103222e2c64b1b174da2e8d07576f978a28f4bb48a6c4
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1fe08fa937d19b55a06be59d94f1e6598942e7b0ac238153ebb95e13baeb4c12
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 52E1A275600349ABDB20EF64CD49BDE77A5EF84704F00481DFA08AB2D1DB78AE45CB89
                                                                                                                                                                                                                                Function 0040F400 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • lstrlenW.KERNEL32( /disable=, /disable=,429E9C66,00000001,?,?,?), ref: 0040F442
                                                                                                                                                                                                                                  • Part of subcall function 0040E540: InterlockedDecrement.KERNEL32(-0000000C), ref: 0040E55B
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477BB4,00477BB4,?), ref: 0040F505
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477BB4), ref: 0040F562
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040F609
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040F662
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040F68A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040F6A8
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$lstrlen
                                                                                                                                                                                                                                • String ID: /disable=
                                                                                                                                                                                                                                • API String ID: 2495739296-49577486
                                                                                                                                                                                                                                • Opcode ID: 89aa98af421b7efe77a67b0cbcc085e7c0e43bbd832dd9c1bc3e6019f59f9791
                                                                                                                                                                                                                                • Instruction ID: 34599be5f36a36b5096e44097a80277bc55837456deac6edc1875b0d68ac37e8
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 89aa98af421b7efe77a67b0cbcc085e7c0e43bbd832dd9c1bc3e6019f59f9791
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7C91F4725083419BC720DF25C881A5BB3E4BF54318F044A3EF894A77A2E738ED49C79A
                                                                                                                                                                                                                                Function 00412A70 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 156COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 00409950: FindResourceW.KERNEL32(00400000,000001F6,FILE), ref: 004099BA
                                                                                                                                                                                                                                  • Part of subcall function 00409950: LoadResource.KERNEL32(00400000,00000000), ref: 004099D6
                                                                                                                                                                                                                                  • Part of subcall function 00409950: SizeofResource.KERNEL32(00400000,00000000), ref: 004099F1
                                                                                                                                                                                                                                  • Part of subcall function 00409950: FreeResource.KERNEL32(00000000), ref: 00409A03
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00412B7F
                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00412BDD
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00412C11
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00412C42
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00412C64
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: LoadStringW.USER32(00400000,00477988,00000100,00000100), ref: 0040D78E
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: lstrlenW.KERNEL32(?,?,?,00477988), ref: 0040D7B5
                                                                                                                                                                                                                                  • Part of subcall function 00406BB0: InterlockedDecrement.KERNEL32(?), ref: 00406C54
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$Resource$Load$CountFindFreeSizeofStringTicklstrlen
                                                                                                                                                                                                                                • String ID: ini_url_default$ini_url_win10_ts$ini_url_win10_tse
                                                                                                                                                                                                                                • API String ID: 3630292680-1327832932
                                                                                                                                                                                                                                • Opcode ID: 66613edeb852080f65c78cd5239106dbb5670ed6db5e8f78a56fb3860f48951c
                                                                                                                                                                                                                                • Instruction ID: d90f9991f23f3d10da1ed0bec7ecc9205f8996d15372a549b00bfed006d94d98
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 66613edeb852080f65c78cd5239106dbb5670ed6db5e8f78a56fb3860f48951c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A451C1B25087458FC300EB64C941B9FB7E8EF84304F04492EF99597391EB78EA49C79A
                                                                                                                                                                                                                                Function 00416CA0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 156COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 00409950: FindResourceW.KERNEL32(00400000,000001F6,FILE), ref: 004099BA
                                                                                                                                                                                                                                  • Part of subcall function 00409950: LoadResource.KERNEL32(00400000,00000000), ref: 004099D6
                                                                                                                                                                                                                                  • Part of subcall function 00409950: SizeofResource.KERNEL32(00400000,00000000), ref: 004099F1
                                                                                                                                                                                                                                  • Part of subcall function 00409950: FreeResource.KERNEL32(00000000), ref: 00409A03
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00416DAF
                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00416E0D
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00416E41
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00416E72
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00416E94
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: LoadStringW.USER32(00400000,00477988,00000100,00000100), ref: 0040D78E
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: lstrlenW.KERNEL32(?,?,?,00477988), ref: 0040D7B5
                                                                                                                                                                                                                                  • Part of subcall function 00406BB0: InterlockedDecrement.KERNEL32(?), ref: 00406C54
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$Resource$Load$CountFindFreeSizeofStringTicklstrlen
                                                                                                                                                                                                                                • String ID: ini_url_default$ini_url_win10_ts$ini_url_win10_tse
                                                                                                                                                                                                                                • API String ID: 3630292680-1327832932
                                                                                                                                                                                                                                • Opcode ID: 37e836effbfe8dec4bafd093721d4a2e333409c9de38d211391c902cf0e479fa
                                                                                                                                                                                                                                • Instruction ID: 407ed14069a3019b2c689f3f64dec58b2ae9cd0e5ca6f8d82b00ad1f226d0bae
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 37e836effbfe8dec4bafd093721d4a2e333409c9de38d211391c902cf0e479fa
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8551A0B65083448FC300EB64D845B9FB7A8EF84704F04492EF99597391DB78DA49C7AA
                                                                                                                                                                                                                                Function 0042D360 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 135libraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042D3B6
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042D4A7
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,Get360SafeVersion), ref: 0042D4DE
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,IsBetaVersion), ref: 0042D4E8
                                                                                                                                                                                                                                  • Part of subcall function 00409F60: InterlockedDecrement.KERNEL32(-000000F4), ref: 00409F71
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AddressProc_memset$DecrementInterlocked
                                                                                                                                                                                                                                • String ID: 0.0.0.0$360ver.dll$Get360SafeVersion$IsBetaVersion
                                                                                                                                                                                                                                • API String ID: 595890866-1298345711
                                                                                                                                                                                                                                • Opcode ID: ea260ec880858a8be4aac313cf7e82781326507da4480488c6135c6dd3d60a72
                                                                                                                                                                                                                                • Instruction ID: da9a3743c1c6c12c52b1eca75e835de34c8854580f5f7b35515f09378ad306fd
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ea260ec880858a8be4aac313cf7e82781326507da4480488c6135c6dd3d60a72
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4C419571A043519FC724EB55EC46B9B73E8BB88708F404D3FF54493281E778E9488B9A
                                                                                                                                                                                                                                Function 0044E8E0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 110COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                • String ID: %02X%02X%02X%02X%02X%02X$* $2$3$7
                                                                                                                                                                                                                                • API String ID: 2102423945-1802369251
                                                                                                                                                                                                                                • Opcode ID: c322caf7c5781a813cd8d933683da2d028181d791d16502a2d102a90b54f71b2
                                                                                                                                                                                                                                • Instruction ID: 265c9267aba8ef908f50d5a95de1f033591374de87a60a76a1aca16602869adc
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c322caf7c5781a813cd8d933683da2d028181d791d16502a2d102a90b54f71b2
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B5412A7150C3C09BD315DB269C517ABBBE8AF96304F14482EF9D8872D1E77C8608876B
                                                                                                                                                                                                                                Function 00414620 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 81libraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00414649
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,IsBetaVersion), ref: 00414708
                                                                                                                                                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 00414713
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AddressFreeLibraryProc_memset
                                                                                                                                                                                                                                • String ID: 360$360ver.dll$IsBetaVersion$Path$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
                                                                                                                                                                                                                                • API String ID: 1444997976-2095131000
                                                                                                                                                                                                                                • Opcode ID: aaf6d84ecdd519764b9ac5969ef700ba8119a30ba9ff9981b8cbffe2d972986c
                                                                                                                                                                                                                                • Instruction ID: 64a39f5c879efb6705e2675acfab9eaf4ee3517b4574f15468837a9cf4f549ce
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: aaf6d84ecdd519764b9ac5969ef700ba8119a30ba9ff9981b8cbffe2d972986c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A7219671604301ABD310DF65D845BAB73E9FFC8749F00892EF48992281EA78D94D8BD6
                                                                                                                                                                                                                                Function 00419940 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 360COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00419B18
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00419B77
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00419C00
                                                                                                                                                                                                                                  • Part of subcall function 00419EC0: GetCurrentProcess.KERNEL32(00000000,0000000D), ref: 00419EF9
                                                                                                                                                                                                                                  • Part of subcall function 00419EC0: FlushInstructionCache.KERNEL32(00000000), ref: 00419F00
                                                                                                                                                                                                                                  • Part of subcall function 0041BAC0: lstrlenW.KERNEL32(?,?,?,00000000,00419C79,?), ref: 0041BAD3
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00419DB9
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00419DDF
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$CacheCurrentFlushInstructionProcesslstrlen
                                                                                                                                                                                                                                • String ID: ppp$ppp
                                                                                                                                                                                                                                • API String ID: 1772758866-2272246440
                                                                                                                                                                                                                                • Opcode ID: 7792fc08039434716f5c242f88e31a5a93968718cf94188a85e0274c38151b1a
                                                                                                                                                                                                                                • Instruction ID: 38b8dc280e520968a1b467e78d51b7731b13b4510ae5974e30e91177187b8622
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7792fc08039434716f5c242f88e31a5a93968718cf94188a85e0274c38151b1a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DAD1E4716043499BD720DF25CC89BDE77A4AF84308F00492EFA45AB2D1EB78ED45CB89
                                                                                                                                                                                                                                Function 00411890 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 217threadCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 00412EF0: IsWindow.USER32(00000000), ref: 00412F9C
                                                                                                                                                                                                                                  • Part of subcall function 00413B40: InterlockedIncrement.KERNEL32(0235D8A8), ref: 00413B5D
                                                                                                                                                                                                                                  • Part of subcall function 00413B90: InterlockedDecrement.KERNEL32(429E9C5A), ref: 00413C7B
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-00000008), ref: 00411934
                                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 004119E9
                                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(0048F134,?,00000080,00000000,00000000,?,00000080,00000001,00000000), ref: 004119FD
                                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(0048F134,?,00000080,00000000,00000000,?,00000080,00000001,00000000), ref: 00411A15
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(000000E0), ref: 00411B1B
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$CriticalSection$CurrentEnterIncrementLeaveThreadWindow
                                                                                                                                                                                                                                • String ID: IDS_TITLE$PNG
                                                                                                                                                                                                                                • API String ID: 289669223-1285263097
                                                                                                                                                                                                                                • Opcode ID: 751d884add6ac73487cdb484e427ecd01a0294af0c575541d7376198eacf924b
                                                                                                                                                                                                                                • Instruction ID: 25c51579aeb556d45c0b35862062959a40d9cf972c6e5f5c20615c30870baffe
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 751d884add6ac73487cdb484e427ecd01a0294af0c575541d7376198eacf924b
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7D71DD71604305ABD700EF24CC85F9BB7A8FF84714F004A2EF944AB2A1DB78E944CB99
                                                                                                                                                                                                                                Function 00406BB0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 191COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0040D850: lstrlenW.KERNEL32(00477988,?,00401466), ref: 0040D873
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00406C54
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-00000009), ref: 00406D08
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00406D2A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00406D51
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00406DC5
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-00000009), ref: 00406DE7
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$lstrlen
                                                                                                                                                                                                                                • String ID: default
                                                                                                                                                                                                                                • API String ID: 2495739296-3814588639
                                                                                                                                                                                                                                • Opcode ID: 813ff7129e4c37a5503e043843476a00b383aad82a4dfad5a6dd44b939702fc0
                                                                                                                                                                                                                                • Instruction ID: 5346c053f97f1c5930e5770575c6423ccbee5cadbb9fd05780c3711e734b2c06
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 813ff7129e4c37a5503e043843476a00b383aad82a4dfad5a6dd44b939702fc0
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EC61AF726097418FD310EB29C845A4FF7E8EF45304F05882EFA95A7292D778ED09C79A
                                                                                                                                                                                                                                Function 00418A80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 123stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: LoadStringW.USER32(00400000,00477988,00000100,00000100), ref: 0040D78E
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: lstrlenW.KERNEL32(?,?,?,00477988), ref: 0040D7B5
                                                                                                                                                                                                                                • lstrlenW.KERNEL32 ref: 00418AE5
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418B90
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418BB2
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418BE5
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418C07
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$lstrlen$LoadString
                                                                                                                                                                                                                                • String ID: IDCANCEL$IDOK
                                                                                                                                                                                                                                • API String ID: 311978648-3557933009
                                                                                                                                                                                                                                • Opcode ID: f8b1f05245ca0c5c7b61f1f2935d0b2ee66868c5c69bc2bda9a9e0c7807449f7
                                                                                                                                                                                                                                • Instruction ID: 686012131a0fddbad262dbfe7866a350300d6474c1ba229e15b5a61a9476becd
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f8b1f05245ca0c5c7b61f1f2935d0b2ee66868c5c69bc2bda9a9e0c7807449f7
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B641D572509B418FD310EB15C855B9FB7E4EF84354F00492EF544A7291EB38AA4ACBEB
                                                                                                                                                                                                                                Function 0042C970 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 120stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0040D850: lstrlenW.KERNEL32(00477988,?,00401466), ref: 0040D873
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe,SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe,?,?,?,?,?,?,?,?,?,?,0046C536,000000FF), ref: 0042CABA
                                                                                                                                                                                                                                  • Part of subcall function 0040E540: InterlockedDecrement.KERNEL32(-0000000C), ref: 0040E55B
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(Path,Path,?,?,?,?,?,?,?,?,?,?,0046C536,000000FF), ref: 0042CAD2
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(360safe.exe,360safe.exe,?,?,?,?,?,?,?,?,?,?,0046C536,000000FF), ref: 0042CAEA
                                                                                                                                                                                                                                  • Part of subcall function 0042D910: GetModuleFileNameW.KERNEL32 ref: 0042D977
                                                                                                                                                                                                                                  • Part of subcall function 0042D910: PathRemoveFileSpecW.SHLWAPI(?), ref: 0042D982
                                                                                                                                                                                                                                  • Part of subcall function 0042D910: lstrlenW.KERNEL32(?,?), ref: 0042D990
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9B72), ref: 0042CB4B
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: lstrlen$DecrementFileInterlocked$ModuleNamePathRemoveSpec
                                                                                                                                                                                                                                • String ID: 360safe.exe$Path$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
                                                                                                                                                                                                                                • API String ID: 1501802763-1025180333
                                                                                                                                                                                                                                • Opcode ID: b93705ad16c887ad1af0f567d563ea2b290a76eec953c0e0eae4fd092ddf9857
                                                                                                                                                                                                                                • Instruction ID: 88878fa406592b3bbd508d006eaa2da203a034dfb31b690254ad35ef7a2c284c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b93705ad16c887ad1af0f567d563ea2b290a76eec953c0e0eae4fd092ddf9857
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C15128B19453408FC780DF6AEC467067BE0AB68718F14853FE558E73A1E7795808CBAE
                                                                                                                                                                                                                                Function 00426E80 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 118COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042D9D0: _memset.LIBCMT ref: 0042DA02
                                                                                                                                                                                                                                  • Part of subcall function 00411010: lstrlenW.KERNEL32(\liveupdatelog,429E9C66,00000000,00000000,\liveupdatelog,?,0046C8B9,000000FF,0042C659,?,?,00000000,00000000), ref: 00411058
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00426F3E
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00426F67
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _memset.LIBCMT ref: 00414764
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncpy.LIBCMT ref: 0041477B
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 0041478E
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 004147A5
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 004147B8
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 004147CF
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 004147E2
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 004147F9
                                                                                                                                                                                                                                  • Part of subcall function 00414740: __wcsnicmp.LIBCMT ref: 0041482A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9B72), ref: 00426FA7
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00426FD0
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • 360, xrefs: 00426F0D
                                                                                                                                                                                                                                • \modules\360Inst.exe, xrefs: 00426EC0
                                                                                                                                                                                                                                • /S /URL:http://pinst.360.cn/zhuomian/desktopsafe.cab, xrefs: 00426F1B
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _wcsncat$DecrementInterlocked$_memset$__wcsnicmp_wcsncpylstrlen
                                                                                                                                                                                                                                • String ID: /S /URL:http://pinst.360.cn/zhuomian/desktopsafe.cab$360$\modules\360Inst.exe
                                                                                                                                                                                                                                • API String ID: 1162702061-3847491120
                                                                                                                                                                                                                                • Opcode ID: 66ae74896d6d069b59f4b9aff0a3cb85c79adb6ad9dcf1bc22e2c4f0b0c4608c
                                                                                                                                                                                                                                • Instruction ID: cdb9a477d15dc318a01e168de7d824406412bfb04119295bd4715b0b699b71f6
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 66ae74896d6d069b59f4b9aff0a3cb85c79adb6ad9dcf1bc22e2c4f0b0c4608c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BA41B6B26087524BC700EF28E841A5FB3A4FF84714F554A2EF45597391E738E909CBAB
                                                                                                                                                                                                                                Function 00427130 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 118COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042D9D0: _memset.LIBCMT ref: 0042DA02
                                                                                                                                                                                                                                  • Part of subcall function 00411010: lstrlenW.KERNEL32(\liveupdatelog,429E9C66,00000000,00000000,\liveupdatelog,?,0046C8B9,000000FF,0042C659,?,?,00000000,00000000), ref: 00411058
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004271EE
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00427217
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _memset.LIBCMT ref: 00414764
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncpy.LIBCMT ref: 0041477B
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 0041478E
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 004147A5
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 004147B8
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 004147CF
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 004147E2
                                                                                                                                                                                                                                  • Part of subcall function 00414740: _wcsncat.LIBCMT ref: 004147F9
                                                                                                                                                                                                                                  • Part of subcall function 00414740: __wcsnicmp.LIBCMT ref: 0041482A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9B72), ref: 00427257
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00427280
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • 360, xrefs: 004271BD
                                                                                                                                                                                                                                • /S /URL:http://pinst.360.cn/360se/wssj_setup.cab, xrefs: 004271CB
                                                                                                                                                                                                                                • \modules\360Inst.exe, xrefs: 00427170
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _wcsncat$DecrementInterlocked$_memset$__wcsnicmp_wcsncpylstrlen
                                                                                                                                                                                                                                • String ID: /S /URL:http://pinst.360.cn/360se/wssj_setup.cab$360$\modules\360Inst.exe
                                                                                                                                                                                                                                • API String ID: 1162702061-3675806594
                                                                                                                                                                                                                                • Opcode ID: 06af8224be8bf29b37b839f8db975c1dc305dcde261f036785ab63bb7602541f
                                                                                                                                                                                                                                • Instruction ID: 7b2d94750889cce6f63d2e50de636596a1320d8c36ca9566644edffafe13a1f4
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 06af8224be8bf29b37b839f8db975c1dc305dcde261f036785ab63bb7602541f
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2041C7B26087528BC700EF28D841A5FB3A4FF84714F544A2EF55193391E73CE90987AB
                                                                                                                                                                                                                                Function 00410490 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(0048D7B8), ref: 004104C4
                                                                                                                                                                                                                                • GetClassInfoExW.USER32(00000000,00000000,?), ref: 00410505
                                                                                                                                                                                                                                • GetClassInfoExW.USER32(?,00000000,?), ref: 0041051F
                                                                                                                                                                                                                                  • Part of subcall function 00406A70: LeaveCriticalSection.KERNEL32(00000000,?,004105E6), ref: 00406A7C
                                                                                                                                                                                                                                • swprintf.LIBCMT ref: 004105A2
                                                                                                                                                                                                                                • GetClassInfoExW.USER32(00000000,00478BB8,?), ref: 004105C7
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ClassInfo$CriticalSection$EnterLeaveswprintf
                                                                                                                                                                                                                                • String ID: 0$ATL:%p
                                                                                                                                                                                                                                • API String ID: 1609745179-2453800769
                                                                                                                                                                                                                                • Opcode ID: 3c592dab102c8c99533bdccc9a7145f530c069ffba358e5b7c5f056c0a6e6753
                                                                                                                                                                                                                                • Instruction ID: 065da1902354d21f9aae0fb52ea8a9b99ab7a18fb6896ab4cd4e9f2fd992da8d
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3c592dab102c8c99533bdccc9a7145f530c069ffba358e5b7c5f056c0a6e6753
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C8415874600300DBDB24DF14C884AAB77A5FF88314F50855EED459B385EBB8D989CFA9
                                                                                                                                                                                                                                Function 0044E100 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 114fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042BA20: _vswprintf_s.LIBCMT ref: 0042BA53
                                                                                                                                                                                                                                • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,0044D075,?,?), ref: 0044E172
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044E19F
                                                                                                                                                                                                                                • _strncpy.LIBCMT ref: 0044E1DB
                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32 ref: 0044E211
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0044E27B
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CloseControlCreateDeviceFileHandle_memset_strncpy_vswprintf_s
                                                                                                                                                                                                                                • String ID: SCSIDISK$\\.\Scsi%d:
                                                                                                                                                                                                                                • API String ID: 170396225-2176293039
                                                                                                                                                                                                                                • Opcode ID: e12c9819881266d14fc842bc0e3168e95b7bd612a3fbd5f1ca7df319b7674cda
                                                                                                                                                                                                                                • Instruction ID: 8734978c6f46a71b2cb27fff565e63b6d82f0e050086b927d5493e2710a08596
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e12c9819881266d14fc842bc0e3168e95b7bd612a3fbd5f1ca7df319b7674cda
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F74165B16483406BF330DF15DC86FABB7D8FB88704F50091EB68996281D7B9A548C75B
                                                                                                                                                                                                                                Function 00404BA0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 105COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$EnvironmentVariable
                                                                                                                                                                                                                                • String ID: C:\Temp$TMP$\Local Settings\Temp$\Local\Temp
                                                                                                                                                                                                                                • API String ID: 182444321-1443901824
                                                                                                                                                                                                                                • Opcode ID: 8cdb106cdfa354b986e9985953353c3833c025913da52a57f858ee0018e6e3d9
                                                                                                                                                                                                                                • Instruction ID: db84d913819c38fe7cad155e2c45fe05206570e2c78ce435b2fdc6bf90b81414
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8cdb106cdfa354b986e9985953353c3833c025913da52a57f858ee0018e6e3d9
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A441BDB46093009FD324DF14E856B6773E4EFC8714F91857AEA1A873E1E734A940CB5A
                                                                                                                                                                                                                                Function 00425D20 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00425D4B
                                                                                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00425D71
                                                                                                                                                                                                                                • std::bad_exception::bad_exception.LIBCMT ref: 00425DF5
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00425E04
                                                                                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00425E19
                                                                                                                                                                                                                                • std::locale::facet::facet_Register.LIBCPMT ref: 00425E34
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
                                                                                                                                                                                                                                • String ID: bad cast
                                                                                                                                                                                                                                • API String ID: 2820251361-3145022300
                                                                                                                                                                                                                                • Opcode ID: 151d385c75104b936115ba08edd10204c042de9651f55e2f6ebda4e65d1b141a
                                                                                                                                                                                                                                • Instruction ID: c6013251fcc9881d26575fdf2b51f0420ccf6a16a2ff63f0233d40a0fa54c3f0
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 151d385c75104b936115ba08edd10204c042de9651f55e2f6ebda4e65d1b141a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5B31B131A147518FD714EF10E885B6A73E0BB54724F804A2FE866972D1DB38A908CB8A
                                                                                                                                                                                                                                Function 00406020 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • CreateFileW.KERNEL32(00406316,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?), ref: 0040604F
                                                                                                                                                                                                                                • ReadFile.KERNEL32(00000000,?,00000040,?,00000000), ref: 0040608B
                                                                                                                                                                                                                                • SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 004060B4
                                                                                                                                                                                                                                • ReadFile.KERNEL32(00000000,?,000000F8,?,00000000), ref: 004060D5
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 004060FC
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: File$Read$CloseCreateHandlePointer
                                                                                                                                                                                                                                • String ID: @$PE
                                                                                                                                                                                                                                • API String ID: 3856724686-957972822
                                                                                                                                                                                                                                • Opcode ID: 260283007240ffd779ea630e865e1c14f958021588d49bb9020e07617ecee351
                                                                                                                                                                                                                                • Instruction ID: 6d74de30b3651289b166314f8db43aca6adbe55372edfb7a2c7273752cb5fd5a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 260283007240ffd779ea630e865e1c14f958021588d49bb9020e07617ecee351
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F421D331648344AFE730DB54DC81FEB7398EB84310F01853EFA99966C0D7749D458BAA
                                                                                                                                                                                                                                Function 00420370 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 004203BD
                                                                                                                                                                                                                                  • Part of subcall function 00453FBC: RaiseException.KERNEL32(?,?,0044FE91,?,?,?,?,?,0044FE91,?,0047F018,0048E270), ref: 00453FFE
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00420401
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00420445
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00420484
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Exception@8Throw$ExceptionRaise
                                                                                                                                                                                                                                • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                                                                                • API String ID: 3476068407-1866435925
                                                                                                                                                                                                                                • Opcode ID: ed1f7c193c97c63541d806f35477227334611c290534710fe48543c89d874a25
                                                                                                                                                                                                                                • Instruction ID: 28c97f25686c6be3dbcb24bb10c9fd4466795d8a0f6b5960e33f18b3f1cecf92
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ed1f7c193c97c63541d806f35477227334611c290534710fe48543c89d874a25
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8931B6B11587406EC310DB55C856F8BB7E8BF84708F40CA1EB599422D2DB7C9508CB6B
                                                                                                                                                                                                                                Function 00414C40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60libraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(?,?), ref: 00414C5F
                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?), ref: 00414C70
                                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(Kernel32.dll,AddDllDirectory,?,?), ref: 00414C9F
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 00414CA2
                                                                                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,00000000,?,?,?), ref: 00414CC6
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Module$Handle$AddressFileLibraryLoadNameProc
                                                                                                                                                                                                                                • String ID: AddDllDirectory$Kernel32.dll
                                                                                                                                                                                                                                • API String ID: 2449539070-4108935418
                                                                                                                                                                                                                                • Opcode ID: 144914392f7a6a23eb53a29e2e85081e25cdb67e94e5ce0a7d3ffed296580924
                                                                                                                                                                                                                                • Instruction ID: 883a002aadf71e7bf4ac8937bd6c3560de3d7a08959856b7e441c6134d737fc7
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 144914392f7a6a23eb53a29e2e85081e25cdb67e94e5ce0a7d3ffed296580924
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7F110A706543845AF7205734DD46BFB7B98EBC4344F44853BEA45C11A1F63C99C4869D
                                                                                                                                                                                                                                Function 004429D0 Relevance: 12.1, APIs: 8, Instructions: 148COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0043EA60: _localeconv.LIBCMT ref: 0043EA67
                                                                                                                                                                                                                                • std::_Locinfo::_Getcvt.LIBCPMTD ref: 00442A36
                                                                                                                                                                                                                                • std::_Locinfo::_Getcvt.LIBCPMTD ref: 00442A60
                                                                                                                                                                                                                                • std::_Locinfo::_Getcvt.LIBCPMTD ref: 00442A8C
                                                                                                                                                                                                                                • std::_Locinfo::_Getcvt.LIBCPMTD ref: 00442ADF
                                                                                                                                                                                                                                • std::_Locinfo::_Getcvt.LIBCPMTD ref: 00442B05
                                                                                                                                                                                                                                • std::_Locinfo::_Getcvt.LIBCPMTD ref: 00442B34
                                                                                                                                                                                                                                • std::_Locinfo::_Getcvt.LIBCPMTD ref: 00442B56
                                                                                                                                                                                                                                • std::_Locinfo::_Getcvt.LIBCPMTD ref: 00442B75
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: GetcvtLocinfo::_std::_$_localeconv
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3990503386-0
                                                                                                                                                                                                                                • Opcode ID: e2b5a17d9f6537bf0c59fa5fa1a31eb67a7e296251ae77fa0327016c0cb24fbb
                                                                                                                                                                                                                                • Instruction ID: aeea621a9bdd06db84159f1367fd25d7ecb611372d3bf85be2b645f20395764f
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e2b5a17d9f6537bf0c59fa5fa1a31eb67a7e296251ae77fa0327016c0cb24fbb
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 615180B4900248AFDB04EF95C891FAEBBB5EF88714F10846EF8056F381D775AA45CB54
                                                                                                                                                                                                                                Function 00444590 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 388COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004445B1
                                                                                                                                                                                                                                • GetFileSizeEx.KERNEL32(?,?,00000000,?,00000000), ref: 004445C3
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 004445F3
                                                                                                                                                                                                                                • SetLastError.KERNEL32(00000008,?,?,?,00004000), ref: 00444603
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ErrorFileLastSize_malloc_memset
                                                                                                                                                                                                                                • String ID: INIT$PE
                                                                                                                                                                                                                                • API String ID: 942205088-3949469810
                                                                                                                                                                                                                                • Opcode ID: a6f34dcb654ef7e749b9fb3bf35b62f4b30492e6a99b898717bdfcb789de5d95
                                                                                                                                                                                                                                • Instruction ID: 525161a9a3df2200c670c902231ba8f22b0c7749a41624f82576125a1b12d51b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a6f34dcb654ef7e749b9fb3bf35b62f4b30492e6a99b898717bdfcb789de5d95
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 20E18FB1A083409BFB24DF15D84176BB6E4FBD4704F04452EF989AB341E778DA05CBAA
                                                                                                                                                                                                                                Function 0040DD70 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 297stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • lstrlenA.KERNEL32(?), ref: 0040DF4C
                                                                                                                                                                                                                                • OutputDebugStringW.KERNEL32(Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.), ref: 0040E058
                                                                                                                                                                                                                                • DebugBreak.KERNEL32 ref: 0040E05E
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00000000,?,?,?,?), ref: 0040E0F8
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class., xrefs: 0040E053
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Debuglstrlen$BreakOutputString
                                                                                                                                                                                                                                • String ID: Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
                                                                                                                                                                                                                                • API String ID: 2932731706-233888011
                                                                                                                                                                                                                                • Opcode ID: 477408de43897f81cebeda185d51791d1ada460d246ed664ab7bac5c1cc04dc0
                                                                                                                                                                                                                                • Instruction ID: a8a2765be8f2cc5e20fb11b764ba61c2351dec6a5e99e694b5cdced79182dc33
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 477408de43897f81cebeda185d51791d1ada460d246ed664ab7bac5c1cc04dc0
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DEA1C3759043528BC7209FA9D88462BB3E0AF54354F18483BE881E73D1E37CDD9AD65E
                                                                                                                                                                                                                                Function 0045226B Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3886058894-0
                                                                                                                                                                                                                                • Opcode ID: 58c02d9be15d209bc269644cc25d2bb3b3a68cbd0389b9becb195a7fb80ab6ee
                                                                                                                                                                                                                                • Instruction ID: 69c4dfccdb301073214012a8336ad375e833877b46ba43cf07cc468424c13ff1
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 58c02d9be15d209bc269644cc25d2bb3b3a68cbd0389b9becb195a7fb80ab6ee
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B751F631900205EBCB208F7A8A4459FBB75EF43326F14825BFC2596293D3B89E59CF59
                                                                                                                                                                                                                                Function 004018B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 185fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,429E9C66), ref: 0040190F
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00401945
                                                                                                                                                                                                                                • ReadFile.KERNEL32(00000000,?,000003FF,?,00000000), ref: 00401965
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,00000001,?,?), ref: 00401B4E
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: File$CloseCreateHandleRead_memset
                                                                                                                                                                                                                                • String ID: install
                                                                                                                                                                                                                                • API String ID: 2837215068-801815929
                                                                                                                                                                                                                                • Opcode ID: 23711e8963be19d075d852f263afb764051ebddf78a22adc46a8dc6512cbd509
                                                                                                                                                                                                                                • Instruction ID: e6e3b2f766b96b64b3b9bc5a84fb4d2db1d0b59d4930fb6030b73dd04a81edab
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 23711e8963be19d075d852f263afb764051ebddf78a22adc46a8dc6512cbd509
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AD71D3B15083819FD320DF25C891BAFF7E4AF89314F04492EF59957291DB389948CB5B
                                                                                                                                                                                                                                Function 00427F00 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 175COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00427FD5
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00428014
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked
                                                                                                                                                                                                                                • String ID: /DIR:$/FROM:
                                                                                                                                                                                                                                • API String ID: 3448037634-429574935
                                                                                                                                                                                                                                • Opcode ID: 6841475a104001eafe291115dd92f0cc907803aa9e2392b79d8b17c97ebdb353
                                                                                                                                                                                                                                • Instruction ID: aa2a2e1348fccce8a80949f1f2bfaf1f6dce349f33a538be244348b762a58e7a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6841475a104001eafe291115dd92f0cc907803aa9e2392b79d8b17c97ebdb353
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 175104726092515BC700DB25EC45B5FB3A8AF4032CF444A2EF854E62D1EB7CEA09C75A
                                                                                                                                                                                                                                Function 00426BF0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 168stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00426C46
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe), ref: 00426D67
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: LoadStringW.USER32(00400000,00477988,00000100,00000100), ref: 0040D78E
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: lstrlenW.KERNEL32(?,?,?,00477988), ref: 0040D7B5
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988), ref: 00426DB1
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(0048B824), ref: 00426E1F
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(0048B90C), ref: 00426E3D
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: lstrlen$DecrementInterlocked$LoadString_memset
                                                                                                                                                                                                                                • String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Desktop.exe
                                                                                                                                                                                                                                • API String ID: 3497097467-1843339676
                                                                                                                                                                                                                                • Opcode ID: f942b36c1173899435728c79fccaff578854380d1e5762b5347561fc6ce2c95a
                                                                                                                                                                                                                                • Instruction ID: cd4fefb987816408838f6b36a6bee78ed89ed88d9898ceccebd2036e4a0c72d6
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f942b36c1173899435728c79fccaff578854380d1e5762b5347561fc6ce2c95a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D451E5716043158BD310EB25E841B9FB3E9EFC4708F95492EF84567281E7789D09CBEA
                                                                                                                                                                                                                                Function 00446180 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 004461A4
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __FF_MSGBANNER.LIBCMT ref: 00450A95
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __NMSG_WRITE.LIBCMT ref: 00450A9C
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C,00457324), ref: 00450AE9
                                                                                                                                                                                                                                • SetLastError.KERNEL32(00000008,00000000,?,?,?,?,00445E4D,00000000,00002000,?,?,00443071,?,?,?,0044353E), ref: 004461B4
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: __lock.LIBCMT ref: 0044FD25
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: ___sbh_find_block.LIBCMT ref: 0044FD30
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: ___sbh_free_block.LIBCMT ref: 0044FD3F
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: RtlFreeHeap.NTDLL(00000000,?,0047E7E8,0000000C,00456D67,00000000,?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C), ref: 0044FD6F
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: GetLastError.KERNEL32(?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C,00457324,?,?,?,00456E21,0000000D), ref: 0044FD80
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ErrorHeapLast$AllocateFree___sbh_find_block___sbh_free_block__lock_malloc
                                                                                                                                                                                                                                • String ID: %012I64X$MAC:$SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards$ServiceName
                                                                                                                                                                                                                                • API String ID: 542790821-1531755283
                                                                                                                                                                                                                                • Opcode ID: e5894c2d7cd86f8242abeecce7650abbea3ded4b798c3fe2aab64e808f7d1402
                                                                                                                                                                                                                                • Instruction ID: bf14487f9234c60a12714145a61ea14be2304e72c439d5b319d75a2d03f32ab7
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e5894c2d7cd86f8242abeecce7650abbea3ded4b798c3fe2aab64e808f7d1402
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B941D271604300ABE310EF55DC85F5FB7E8FBC5B58F40052EF94892281E678E90887AB
                                                                                                                                                                                                                                Function 0043B7D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 143COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _swscanf.LIBCMT ref: 0043B84E
                                                                                                                                                                                                                                  • Part of subcall function 00453C78: _vscan_fn.LIBCMT ref: 00453C8F
                                                                                                                                                                                                                                • _swscanf.LIBCMT ref: 0043B883
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _swscanf$_vscan_fn
                                                                                                                                                                                                                                • String ID: $ $%lf$' is not a number.
                                                                                                                                                                                                                                • API String ID: 241522225-717049023
                                                                                                                                                                                                                                • Opcode ID: 181aa48d2fde37d087aeea0627cffc23e7998f2597da5239d4c4dc3d9e046720
                                                                                                                                                                                                                                • Instruction ID: 867483c6eb0ecb789c21fb85199e43ad517e33e7f99e3d0bf1f69f831c20e2ae
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 181aa48d2fde37d087aeea0627cffc23e7998f2597da5239d4c4dc3d9e046720
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5C514D71D00209EFCB14DF94D891FEEB7B4AF58304F1081AEE55967281DB385A84CF98
                                                                                                                                                                                                                                Function 0044DD30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$__strlwr_strncat_vswprintf_s
                                                                                                                                                                                                                                • String ID: %02x
                                                                                                                                                                                                                                • API String ID: 259801040-560843007
                                                                                                                                                                                                                                • Opcode ID: b6497b6a9e08ef408e624e86d77278f65c8358be8ddc12433001758acc1d30de
                                                                                                                                                                                                                                • Instruction ID: 751cc701eba87a1afdc26ceb5163764bf54e35fcece075daf4ca5baaf4c8cde0
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b6497b6a9e08ef408e624e86d77278f65c8358be8ddc12433001758acc1d30de
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1041C1716087419BE334DB35C895FEB77E8EF84304F10491EFA9987251EA38D5088B96
                                                                                                                                                                                                                                Function 0042F3B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 130COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042F3D6
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-0000000C), ref: 0042F486
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked_memset
                                                                                                                                                                                                                                • String ID: @$GET$HTTP/1.1$s.360.cn
                                                                                                                                                                                                                                • API String ID: 4153837582-3850938256
                                                                                                                                                                                                                                • Opcode ID: f6321bc7674ae77a3d6fea5c6eabe93411777f76c494e6f6b38846862b281d7d
                                                                                                                                                                                                                                • Instruction ID: 4e1a1276cc4e30eae7376a03df8c0417462c4613ef2c50817f031642ca80dc63
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f6321bc7674ae77a3d6fea5c6eabe93411777f76c494e6f6b38846862b281d7d
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C641C772A043196BD320EF11EC46F5F77B8EF54710F50453EFA09A61D1EBA4A9088B9E
                                                                                                                                                                                                                                Function 0042E3B0 Relevance: 10.6, APIs: 7, Instructions: 124fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042A8D0: _memset.LIBCMT ref: 0042A906
                                                                                                                                                                                                                                  • Part of subcall function 0042A8D0: _memset.LIBCMT ref: 0042A91D
                                                                                                                                                                                                                                  • Part of subcall function 0042A8D0: GetTempPathW.KERNEL32(00000400,?,?,?,?,00000000,?,00000000,?,ini_url_default,?,?,?,?,?), ref: 0042A932
                                                                                                                                                                                                                                  • Part of subcall function 0042A8D0: _memset.LIBCMT ref: 0042A944
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042E40A
                                                                                                                                                                                                                                • DeleteFileW.KERNEL32(?,00000000,?,ini_url_default,?,?,?,?,?), ref: 0042E42F
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042E499
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042E4BB
                                                                                                                                                                                                                                • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0042E4D0
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042E4E7
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042E504
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$_memset$DeleteFile$PathTemp
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2302944535-0
                                                                                                                                                                                                                                • Opcode ID: cff8297d40dcc74323fc5fb3da2e1a3659b6739e6a11ff786d271852e44e2d29
                                                                                                                                                                                                                                • Instruction ID: d0df3373035fc281b8022de5bbf9b278b59a05aa6b86d2d1349e2a756b1ce4ab
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: cff8297d40dcc74323fc5fb3da2e1a3659b6739e6a11ff786d271852e44e2d29
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3A4129717056258BD310FB16EC41A5FB3A4EF44718F844A3AE91497351E72CEA0AC7AF
                                                                                                                                                                                                                                Function 00436040 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 120COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 004360D9
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0043615D
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 004361FE
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • Negative integer can not be converted to unsigned integer, xrefs: 004360AF
                                                                                                                                                                                                                                • Real out of unsigned integer range, xrefs: 0043612D
                                                                                                                                                                                                                                • Type is not convertible to uint, xrefs: 004361C8
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Exception@8Throw
                                                                                                                                                                                                                                • String ID: Negative integer can not be converted to unsigned integer$Real out of unsigned integer range$Type is not convertible to uint
                                                                                                                                                                                                                                • API String ID: 2005118841-1738163505
                                                                                                                                                                                                                                • Opcode ID: 9b11ebc9b928f51ef935b98ebbd2524952988af2c2dc6e3aebbbf544d3532417
                                                                                                                                                                                                                                • Instruction ID: a58dfc0bcab04a32b4a1ed6dada8498c9670b474357a58e0ed076d57c41911de
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9b11ebc9b928f51ef935b98ebbd2524952988af2c2dc6e3aebbbf544d3532417
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 14519C70900119EBCB28DF94DC55BDEB374BB49304F1086EEE56967281DB789E88CF88
                                                                                                                                                                                                                                Function 00405180 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(006CECF8), ref: 004051CD
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(006C8FB0), ref: 004051F8
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(0048B824), ref: 00405223
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(0235D8A8), ref: 0040524E
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(0235D8A8), ref: 00405279
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked
                                                                                                                                                                                                                                • String ID: l
                                                                                                                                                                                                                                • API String ID: 3448037634-1044279616
                                                                                                                                                                                                                                • Opcode ID: cfd5e5baf2a28324aaa256cdd17db5a8f74f3d4b5efcda92f09564ae3a4c1fac
                                                                                                                                                                                                                                • Instruction ID: 20013c3f58a620026cdfc8c4a14874bf41fdcfde577af68d41eda09dacbb9d67
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: cfd5e5baf2a28324aaa256cdd17db5a8f74f3d4b5efcda92f09564ae3a4c1fac
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: ED4194B2905A458FD600DB68DC86A1B77A8EF10728B14473BF521973E2E73CD804CF99
                                                                                                                                                                                                                                Function 004016F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(checksum,429E9C66), ref: 00401752
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(-0000000C), ref: 004017B8
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0046C240), ref: 004017D1
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004017F4
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040181D
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: LoadStringW.USER32(00400000,00477988,00000100,00000100), ref: 0040D78E
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: lstrlenW.KERNEL32(?,?,?,00477988), ref: 0040D7B5
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlockedlstrlen$Decrement$IncrementLoadString
                                                                                                                                                                                                                                • String ID: checksum
                                                                                                                                                                                                                                • API String ID: 1398555518-3731873690
                                                                                                                                                                                                                                • Opcode ID: 4541c4af1837611996c57eb14c76230f7801443edc193343d32c9ea4098d54f2
                                                                                                                                                                                                                                • Instruction ID: 7b0006758d533f601e74473b3a89a6f2e15f305417de060ff2d94be5b5d4d6f5
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4541c4af1837611996c57eb14c76230f7801443edc193343d32c9ea4098d54f2
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AA41C8B25042029FC304DF29DC81A6BB3E5EB94715F144A3FF851D73A1E738D905876A
                                                                                                                                                                                                                                Function 00415270 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 116stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004152E7
                                                                                                                                                                                                                                  • Part of subcall function 0044EF30: _memset.LIBCMT ref: 0044EF71
                                                                                                                                                                                                                                  • Part of subcall function 0044EF30: _memset.LIBCMT ref: 0044EF8E
                                                                                                                                                                                                                                  • Part of subcall function 0044EF30: lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,0044D075,00000000), ref: 0044EF9D
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,000000C8,?,?), ref: 0041533F
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004153B2
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004153D0
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • &tfl=%u&tp=t&tst=%d&ttdl=%u&ttm=%u&ttup=120&vh=1.3.0.1361&vp=1.3.0.1320&softname=360TS, xrefs: 00415371
                                                                                                                                                                                                                                • http://s.360safe.com/safei18n/dimana.htm?lr=1&mid=%s&mod=360Installer.exe&ph=%s&p2p=1&t_id=%s&tads=%u&tdl=%u&tds=%u&terr=%d&tes=, xrefs: 00415325
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$DecrementInterlockedlstrlen
                                                                                                                                                                                                                                • String ID: &tfl=%u&tp=t&tst=%d&ttdl=%u&ttm=%u&ttup=120&vh=1.3.0.1361&vp=1.3.0.1320&softname=360TS$http://s.360safe.com/safei18n/dimana.htm?lr=1&mid=%s&mod=360Installer.exe&ph=%s&p2p=1&t_id=%s&tads=%u&tdl=%u&tds=%u&terr=%d&tes=
                                                                                                                                                                                                                                • API String ID: 4122383332-2663782892
                                                                                                                                                                                                                                • Opcode ID: c520671fa0a8afe7be7813d592bed7108f6bb1f606c7574b6f015b6d714770da
                                                                                                                                                                                                                                • Instruction ID: 7f16b0d9fab387380cbf67815f6b07a89fe51cdbf48699444329aa7cd97b7e4d
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c520671fa0a8afe7be7813d592bed7108f6bb1f606c7574b6f015b6d714770da
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EA4192715087409FD320DB15DC81EEBB3E8EBC8714F544A2EF85893391E778AD44879A
                                                                                                                                                                                                                                Function 00435E50 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 113COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00435EF9
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00435F74
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00435FEA
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • integer out of signed integer range, xrefs: 00435ECF
                                                                                                                                                                                                                                • Type is not convertible to int, xrefs: 00435FB4
                                                                                                                                                                                                                                • Real out of signed integer range, xrefs: 00435F44
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Exception@8Throw
                                                                                                                                                                                                                                • String ID: Real out of signed integer range$Type is not convertible to int$integer out of signed integer range
                                                                                                                                                                                                                                • API String ID: 2005118841-3748601619
                                                                                                                                                                                                                                • Opcode ID: 9af3826c423b42d26673a46962221595ca3fe48c47ad200f9717dbc62f386915
                                                                                                                                                                                                                                • Instruction ID: d63f492f1730043278628a6251615ff7d6922190e39bd9df08f5f1b19b860079
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9af3826c423b42d26673a46962221595ca3fe48c47ad200f9717dbc62f386915
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D341C070900119EBCB18DF60DC55BDDB374BB45304F1086EEE129672C1DBB86A88CF89
                                                                                                                                                                                                                                Function 0042B5D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 105COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked_memset
                                                                                                                                                                                                                                • String ID: 360$<$@$tzG
                                                                                                                                                                                                                                • API String ID: 4153837582-102936341
                                                                                                                                                                                                                                • Opcode ID: 02316f0f493c2a88d11bea0bd08a52371b8587f40760d0c9e5f6968b32872426
                                                                                                                                                                                                                                • Instruction ID: 3b7d015fe067603dc6342f70c87515ea13e32e177df9a7bc9689f977645f610c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 02316f0f493c2a88d11bea0bd08a52371b8587f40760d0c9e5f6968b32872426
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0B3198716043149FD700DF14D885B5FB7E8EF84B14F00492EFA058B390DB79AA08CB9A
                                                                                                                                                                                                                                Function 0041C270 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 96COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedIncrement.KERNEL32(00000000), ref: 00405119
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedDecrement.KERNEL32(-0000000C), ref: 00405155
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: lstrlenW.KERNEL32(?,?,429E9C66,?,00000000,IDS_QUIT,?,0046E828,000000FF,00403E61,?,?,ini_url_win10_tse,?), ref: 00405132
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041C30B
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9B72), ref: 0041C334
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041C365
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$Incrementlstrlen
                                                                                                                                                                                                                                • String ID: IDS_UPDATE_QUESTION$IDS_UPDATE_WARNING_COTENT$IDS_UPDATE_WARNING_TITLE
                                                                                                                                                                                                                                • API String ID: 1461404603-2369481225
                                                                                                                                                                                                                                • Opcode ID: d7b6d5b11989c154cdf07eb74ff880b0cbdd02410106d35afc10e6d4e2235b70
                                                                                                                                                                                                                                • Instruction ID: ff4465f592d72e8d570eac7504eefd2fc108fd327d72c14b843e82d3b116997f
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d7b6d5b11989c154cdf07eb74ff880b0cbdd02410106d35afc10e6d4e2235b70
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8931C6B19087414BC710DB69CC9579F77E8EF81328F044B2EF468972D1D738A8488B9A
                                                                                                                                                                                                                                Function 0042A8D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042A906
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042A91D
                                                                                                                                                                                                                                • GetTempPathW.KERNEL32(00000400,?,?,?,?,00000000,?,00000000,?,ini_url_default,?,?,?,?,?), ref: 0042A932
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042A944
                                                                                                                                                                                                                                  • Part of subcall function 0042A800: _memset.LIBCMT ref: 0042A847
                                                                                                                                                                                                                                  • Part of subcall function 0042A800: _wcsncpy.LIBCMT ref: 0042A8A6
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00000000,?,ini_url_default,?,?), ref: 0042A9F2
                                                                                                                                                                                                                                  • Part of subcall function 0040E540: InterlockedDecrement.KERNEL32(-0000000C), ref: 0040E55B
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$DecrementInterlockedPathTemp_wcsncpylstrlen
                                                                                                                                                                                                                                • String ID: .tmp
                                                                                                                                                                                                                                • API String ID: 603731571-2986845003
                                                                                                                                                                                                                                • Opcode ID: ee6f2838d25fe1505d244325af2c05a2a4dc13bbd92afbc115eaaa477585c61b
                                                                                                                                                                                                                                • Instruction ID: d7244afcd1275b356fb0cc01f0bfcb531f67616a9e37455d1922c23cbe9ee070
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ee6f2838d25fe1505d244325af2c05a2a4dc13bbd92afbc115eaaa477585c61b
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7031F9B26043409BD324DB65EC42BDB73F4FF88344F458C2EFA4987292EA349545CB9A
                                                                                                                                                                                                                                Function 00404910 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48libraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(ntdll.dll), ref: 00404929
                                                                                                                                                                                                                                • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00404940
                                                                                                                                                                                                                                • PathAppendW.SHLWAPI(?,ntdll.dll), ref: 00404953
                                                                                                                                                                                                                                  • Part of subcall function 00406650: GetModuleHandleW.KERNEL32(Kernel32.dll,AddDllDirectory,00404966,?), ref: 00406663
                                                                                                                                                                                                                                  • Part of subcall function 00406650: GetProcAddress.KERNEL32(00000000), ref: 0040666A
                                                                                                                                                                                                                                  • Part of subcall function 00406650: LoadLibraryExW.KERNEL32(fI@,00000000,-00000800,00404966,?), ref: 00406694
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 00404978
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AddressHandleModuleProc$AppendDirectoryLibraryLoadPathSystem
                                                                                                                                                                                                                                • String ID: RtlGetVersion$ntdll.dll
                                                                                                                                                                                                                                • API String ID: 2032197054-1489217083
                                                                                                                                                                                                                                • Opcode ID: da970998cf4aa03a093c3919d2174fbe5c4dc6be8f03225215c6c842f991493a
                                                                                                                                                                                                                                • Instruction ID: ff364399a3d339dcd518baccefc22a53f8348372b9928f5a3d68d5dc8591173e
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: da970998cf4aa03a093c3919d2174fbe5c4dc6be8f03225215c6c842f991493a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 301165B06143415BD724DF75C846BDF77E9AF88700F80887EA589C2290EA38D6888B56
                                                                                                                                                                                                                                Function 0042D2B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042D2DF
                                                                                                                                                                                                                                • GetTempPathW.KERNEL32(00000104,?,?,006C1D00,00000002), ref: 0042D2F4
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042D306
                                                                                                                                                                                                                                • GetTempFileNameW.KERNEL32(?,!@tmpini%^&,00000000,?,?,?,?,?,006C1D00,00000002), ref: 0042D322
                                                                                                                                                                                                                                • DeleteFileW.KERNEL32(?,?,?,?,?,006C1D00,00000002), ref: 0042D32D
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: FileTemp_memset$DeleteNamePath
                                                                                                                                                                                                                                • String ID: !@tmpini%^&
                                                                                                                                                                                                                                • API String ID: 433304728-1065504728
                                                                                                                                                                                                                                • Opcode ID: 3624ef11a704a5efa51ef6474994493a33ff55cd879fc4c3761faf7e5cc15719
                                                                                                                                                                                                                                • Instruction ID: b07b65b25c8889d47129d28635da0e2c07c2e1956b1347e52c85d8b144426979
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3624ef11a704a5efa51ef6474994493a33ff55cd879fc4c3761faf7e5cc15719
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 280175B15443446FD320EB54EC86FEB73A4AB84705F40892DB65C86191EA74954CC7EA
                                                                                                                                                                                                                                Function 00406650 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 24libraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(Kernel32.dll,AddDllDirectory,00404966,?), ref: 00406663
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 0040666A
                                                                                                                                                                                                                                • LoadLibraryExW.KERNEL32(fI@,00000000,-00000800,00404966,?), ref: 00406694
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AddressHandleLibraryLoadModuleProc
                                                                                                                                                                                                                                • String ID: AddDllDirectory$Kernel32.dll$fI@
                                                                                                                                                                                                                                • API String ID: 310444273-2169087608
                                                                                                                                                                                                                                • Opcode ID: bcb6069a110ac3013efe1edae33b858103ecf146d7182f5477fc68d81060d2c4
                                                                                                                                                                                                                                • Instruction ID: 63fb2fa8be1becdc473a3c18afbaacd57eb5f796d5a3771ce8076dfb635ae29e
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bcb6069a110ac3013efe1edae33b858103ecf146d7182f5477fc68d81060d2c4
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4CE04FB26A46425FD7509BB8DC0BF4637E4AB20B41F548637B10AD21E0D63CD0C0CA1C
                                                                                                                                                                                                                                Function 00420980 Relevance: 9.3, APIs: 6, Instructions: 270stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004209D9
                                                                                                                                                                                                                                • _strtok.LIBCMT ref: 00420A59
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001,?,?,?,000000FF,00000001,?,?,00000000), ref: 00420BAF
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,?,000000FF,00000001,?,?,00000000), ref: 00420BD3
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00420C1A
                                                                                                                                                                                                                                • _strtok.LIBCMT ref: 00420C6E
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _strtok$ByteCharDecrementInterlockedMultiWide_memsetlstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1907773041-0
                                                                                                                                                                                                                                • Opcode ID: 963f32b87a69a573bb98b8de71c8256fd1e6b52c2a3137073d2116283c088669
                                                                                                                                                                                                                                • Instruction ID: 33ebc5c8fbdd4a46963d6256f7c0d3424beaf522cc6534cd5d11c18748daaef6
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 963f32b87a69a573bb98b8de71c8256fd1e6b52c2a3137073d2116283c088669
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3AA126B1A083508FC720DF25D88095BBBE5EF95314F940A2EF49587353E738E849C79A
                                                                                                                                                                                                                                Function 00421300 Relevance: 9.3, APIs: 6, Instructions: 270stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00421359
                                                                                                                                                                                                                                • _strtok.LIBCMT ref: 004213D9
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001,?,?,?,000000FF,00000001,?,?,00000000), ref: 0042152F
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,?,000000FF,00000001,?,?,00000000), ref: 00421553
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042159A
                                                                                                                                                                                                                                • _strtok.LIBCMT ref: 004215EE
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _strtok$ByteCharDecrementInterlockedMultiWide_memsetlstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1907773041-0
                                                                                                                                                                                                                                • Opcode ID: f7e64b0507663462296b0c53dabf03161ad8390c51e601ce8f4840dea3965510
                                                                                                                                                                                                                                • Instruction ID: 1f2e64c096017abe02d86afea1fe501107b5ab0244c6e9d09ca5a4deccb46b36
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f7e64b0507663462296b0c53dabf03161ad8390c51e601ce8f4840dea3965510
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1FA13671A083909FD710EF25D8809AFB7E5AFA5314F94092FF48987361D738E849C79A
                                                                                                                                                                                                                                Function 004054C0 Relevance: 9.2, APIs: 6, Instructions: 189COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00405548
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-0000000A), ref: 00405600
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9C5A), ref: 00405622
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040564C
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004056C0
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004056E6
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3448037634-0
                                                                                                                                                                                                                                • Opcode ID: 7d811c8efb80bcf7c9d887b0f6405f7f6a0bd3db4e3de3fcedb7160c5557ecb8
                                                                                                                                                                                                                                • Instruction ID: d70d7daaa2edc4edc7b96ffd42ff747a82c184ad0da707dbad3341ade686e101
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7d811c8efb80bcf7c9d887b0f6405f7f6a0bd3db4e3de3fcedb7160c5557ecb8
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A561E572905A419FC310EB19C845A5FB7F4EF85304F40483EFA54A72A2E739ED09CB9A
                                                                                                                                                                                                                                Function 0045BE44 Relevance: 9.1, APIs: 6, Instructions: 148COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetStringTypeW.KERNEL32(00000001,00471874,00000001,?,00000002,00000000,-0000009C,?,?,?,0045C0AE,00000001,?,-00000080,?,?), ref: 0045BEF3
                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,0045C0AE,00000001,?,-00000080,?,?,?,?,-00000080,?,00000001,-00000080,-00000080,00000008,?), ref: 0045BF05
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(-00000080,00000000,?,?,00000000,00000000,00000002,00000000,-0000009C,?,?,?,0045C0AE,00000001,?,-00000080), ref: 0045BF6A
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0045BF9F
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0045BFBF
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,-00000080,?,00000001,-00000080,-00000080,00000008,?,-00000080), ref: 0045BFD4
                                                                                                                                                                                                                                • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0045BFE2
                                                                                                                                                                                                                                • __freea.LIBCMT ref: 0045BFEC
                                                                                                                                                                                                                                • ___ansicp.LIBCMT ref: 0045C016
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ByteCharMultiStringTypeWide$ErrorLast___ansicp__freea_malloc_memset
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2898540435-0
                                                                                                                                                                                                                                • Opcode ID: e9355553bd729a69260666d8b2264eb4aa5ce1c1e771292ef60446d7f8163f55
                                                                                                                                                                                                                                • Instruction ID: 23ffe056d9d6f0958b874f9c7829c196ab01b7fb8abe02c4feb1af0ed407c944
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e9355553bd729a69260666d8b2264eb4aa5ce1c1e771292ef60446d7f8163f55
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5C412472604189EFDB518FA08C949EE7FA8EB15745B14006FED058B292D338DE49CB9A
                                                                                                                                                                                                                                Function 00401B80 Relevance: 9.1, APIs: 6, Instructions: 140COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,429E9C66), ref: 00401BCC
                                                                                                                                                                                                                                  • Part of subcall function 00401D40: lstrlenA.KERNEL32(00000017), ref: 00401E14
                                                                                                                                                                                                                                  • Part of subcall function 00401D40: MultiByteToWideChar.KERNEL32(00000000,00000000,00000034,000000FF,GPLD,00000001), ref: 00401E4D
                                                                                                                                                                                                                                  • Part of subcall function 00401D40: lstrlenW.KERNEL32(GPLD), ref: 00401E6C
                                                                                                                                                                                                                                • __time64.LIBCMT ref: 00401C09
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00401C36
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00401C97
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000,?,00000000,00000400,00000000,?), ref: 00401CDE
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(00000007), ref: 00401CFA
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlockedlstrlen$ByteCharCloseCreateEventHandleMultiWide__time64_memset
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1652060392-0
                                                                                                                                                                                                                                • Opcode ID: 06dabd7458f2f804043287c24de02a0f96411c5b6b39c4ff3511f36a59741741
                                                                                                                                                                                                                                • Instruction ID: 01e33182c3840db056b60db7c027c5db007bca471e6e5dffbb1bd65a2855d086
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 06dabd7458f2f804043287c24de02a0f96411c5b6b39c4ff3511f36a59741741
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B651A471D04549AFDB10DFA5D885AEFB7B8FF04314F10812AF518E7291E738A904CBA9
                                                                                                                                                                                                                                Function 0040D260 Relevance: 9.1, APIs: 6, Instructions: 127libraryCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000002,429E9C66,?,?,?,?,?,?,?,?,0046CC20,000000FF), ref: 0040D2C4
                                                                                                                                                                                                                                • FindResourceW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0046CC20,000000FF), ref: 0040D2E5
                                                                                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0046CC20,000000FF), ref: 0040D3BB
                                                                                                                                                                                                                                  • Part of subcall function 0040B9A0: GetLastError.KERNEL32(0040D39B,?,?,?,?,?,?,?,?,?,?,0046CC20,000000FF), ref: 0040B9A0
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Library$ErrorFindFreeLastLoadResource
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3418355812-0
                                                                                                                                                                                                                                • Opcode ID: 5301afb5f5dd6e9aa9d917d58cbfa321e90795557e80631cddf1549b772df82e
                                                                                                                                                                                                                                • Instruction ID: 973c157687dbf4d0b0260d00eda06b7c7f852e55b7cce78f1f26c4b87c04e7a5
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5301afb5f5dd6e9aa9d917d58cbfa321e90795557e80631cddf1549b772df82e
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 444152B1900149DFCB10DF95C985AAE77B8FF48314F50413EE909B7281D7385E458BAA
                                                                                                                                                                                                                                Function 00428BA0 Relevance: 9.1, APIs: 6, Instructions: 101stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00428C4B
                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 00428C61
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00428C79
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 00428C97
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(-000000F4), ref: 00428CC1
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00000000,429E9C66,00000000,00000000,?,00000000), ref: 00428CDE
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memsetlstrlen$FileIncrementInterlockedModuleName
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1959812916-0
                                                                                                                                                                                                                                • Opcode ID: 7e3bdf327f39a2b810bcde4e87095c37a2747ad968c66533975c3016cf500417
                                                                                                                                                                                                                                • Instruction ID: 184e83a686cbec21891b513560d398a5c71bf28200d8139b8dc7521fa9f2f8c7
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7e3bdf327f39a2b810bcde4e87095c37a2747ad968c66533975c3016cf500417
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FB3150B16052409FD320DB69EC45B5BB7E4EB88718F40493EF619972A2E7389904CB9A
                                                                                                                                                                                                                                Function 00447D40 Relevance: 9.1, APIs: 6, Instructions: 93synchronizationCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,00444638,00000000,00000000,00000CCC,00000040,?,?,?,00004000), ref: 00447DB9
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00447DE9
                                                                                                                                                                                                                                • TlsSetValue.KERNEL32(?,00000000,?,00444638,00000000,00000000,00000CCC,00000040,?,?,?,00004000), ref: 00447DFE
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00447E18
                                                                                                                                                                                                                                • ReleaseMutex.KERNEL32(?,00000004,0047F12C), ref: 00447E4E
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Exception@8Throw$MutexObjectReleaseSingleValueWait
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2684265641-0
                                                                                                                                                                                                                                • Opcode ID: 9b431dc82fcd68147dd878b0f17d103c5133fa7dccc45d0976d5c7c7b3097f52
                                                                                                                                                                                                                                • Instruction ID: 8ab2c25b6b8ca2d6d6b4ae2b761ee097f0f3e8a293684e76e6010f6be86e0883
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9b431dc82fcd68147dd878b0f17d103c5133fa7dccc45d0976d5c7c7b3097f52
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4931D371A04604AFDB11CFA8DC45AAEB7B8EB44774F60476BE924D3390E7399D018B98
                                                                                                                                                                                                                                Function 004479F0 Relevance: 9.1, APIs: 6, Instructions: 88memoryCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetProcessHeap.KERNEL32(429E9C66), ref: 00447A19
                                                                                                                                                                                                                                • HeapLock.KERNEL32(00000000), ref: 00447A40
                                                                                                                                                                                                                                • HeapWalk.KERNEL32(00000000,?), ref: 00447A5A
                                                                                                                                                                                                                                • HeapWalk.KERNEL32(00000000,?), ref: 00447A9D
                                                                                                                                                                                                                                • HeapUnlock.KERNEL32(00000000), ref: 00447ADA
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Heap$Walk$LockProcessUnlock
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2227978497-0
                                                                                                                                                                                                                                • Opcode ID: fd9400ddc93011079a7edf4ea6a881caa66c2905462d05b8f3e662f4f516a133
                                                                                                                                                                                                                                • Instruction ID: 56f932752473a535b0467d235a6733e7cf4c4e063e7a877f01ca0aca72216fd6
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fd9400ddc93011079a7edf4ea6a881caa66c2905462d05b8f3e662f4f516a133
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FC31E8711083059FE710CF15D844B6FBBE8EB85720F40452FF54057361D779998ACB6A
                                                                                                                                                                                                                                Function 00455664 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __CreateFrameInfo.LIBCMT ref: 0045568C
                                                                                                                                                                                                                                  • Part of subcall function 0045442C: __getptd.LIBCMT ref: 0045443A
                                                                                                                                                                                                                                  • Part of subcall function 0045442C: __getptd.LIBCMT ref: 00454448
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 00455696
                                                                                                                                                                                                                                  • Part of subcall function 00456D76: __getptd_noexit.LIBCMT ref: 00456D79
                                                                                                                                                                                                                                  • Part of subcall function 00456D76: __amsg_exit.LIBCMT ref: 00456D86
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 004556A4
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 004556B2
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 004556BD
                                                                                                                                                                                                                                • _CallCatchBlock2.LIBCMT ref: 004556E3
                                                                                                                                                                                                                                  • Part of subcall function 004544D1: __CallSettingFrame@12.LIBCMT ref: 0045451D
                                                                                                                                                                                                                                  • Part of subcall function 0045578A: __getptd.LIBCMT ref: 00455799
                                                                                                                                                                                                                                  • Part of subcall function 0045578A: __getptd.LIBCMT ref: 004557A7
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1602911419-0
                                                                                                                                                                                                                                • Opcode ID: 31026e3b0e1c083ea7effc5ec6be5d6f6f8d95f9b315bec4d5d1bc6f1d4d5031
                                                                                                                                                                                                                                • Instruction ID: f047e4ec46d9b835bb8d84e7e8a6332eea2080dbe78c3be3e1874fb611c94238
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 31026e3b0e1c083ea7effc5ec6be5d6f6f8d95f9b315bec4d5d1bc6f1d4d5031
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 28114C71D00209DFDB00EFA5C545BED77B0FF0831AF10846AF814AB252EB388A599F55
                                                                                                                                                                                                                                Function 00443B10 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 272COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00443B64
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 00443C65
                                                                                                                                                                                                                                • SetLastError.KERNEL32(00000008,00002000,00000000,?), ref: 00443C75
                                                                                                                                                                                                                                  • Part of subcall function 00445300: _malloc.LIBCMT ref: 0044530C
                                                                                                                                                                                                                                  • Part of subcall function 00445300: SetLastError.KERNEL32(00000008,00000000,00443BD0,00000000,00002000,00000000,?), ref: 0044531E
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ErrorLast_malloc$_memset
                                                                                                                                                                                                                                • String ID: pLG$xMG
                                                                                                                                                                                                                                • API String ID: 1834304950-999335393
                                                                                                                                                                                                                                • Opcode ID: 6f298807e8b257d43e28adc5b3ce8812af06314fc0efc6c8533389370bc4bed1
                                                                                                                                                                                                                                • Instruction ID: b3c5fddf856ca4a343a4355c55f70a21b507dc5ff04cc7028c164c9005d27ba9
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6f298807e8b257d43e28adc5b3ce8812af06314fc0efc6c8533389370bc4bed1
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 03A1AAB19083058BE710DF55D88076BB7E4AFC4B49F14492EF88997341E778EA08CB9B
                                                                                                                                                                                                                                Function 004228C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedIncrement.KERNEL32(00000000), ref: 00405119
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedDecrement.KERNEL32(-0000000C), ref: 00405155
                                                                                                                                                                                                                                  • Part of subcall function 00419EC0: GetCurrentProcess.KERNEL32(00000000,0000000D), ref: 00419EF9
                                                                                                                                                                                                                                  • Part of subcall function 00419EC0: FlushInstructionCache.KERNEL32(00000000), ref: 00419F00
                                                                                                                                                                                                                                • IsWindow.USER32(00000000), ref: 00422987
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-0000000C), ref: 00422AC4
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00422AE6
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$CacheCurrentFlushIncrementInstructionProcessWindow
                                                                                                                                                                                                                                • String ID: IDCANCEL$IDS_HIDETRAY
                                                                                                                                                                                                                                • API String ID: 4044446434-4267339664
                                                                                                                                                                                                                                • Opcode ID: 04e731d98da9d104b2050c49c928df4327a7af75354189419b3e3d0bbaca382f
                                                                                                                                                                                                                                • Instruction ID: 2e9b88c209fa5afd8faed9a73198784e1524e02287815dbc29a4277c2a79cb1b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 04e731d98da9d104b2050c49c928df4327a7af75354189419b3e3d0bbaca382f
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FA51B375741308ABDB20EF20DC46FDE73A5EF88714F004629FA05AB2D1DBB8AD418799
                                                                                                                                                                                                                                Function 0044E6C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 165stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044E6FF
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044E7C7
                                                                                                                                                                                                                                  • Part of subcall function 0044E5B0: CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000104,00000000), ref: 0044E5FE
                                                                                                                                                                                                                                • lstrcmpA.KERNEL32(?,00000000), ref: 0044E7F8
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • ServiceName, xrefs: 0044E79C
                                                                                                                                                                                                                                • SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards, xrefs: 0044E710
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$CreateFilelstrcmp
                                                                                                                                                                                                                                • String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards$ServiceName
                                                                                                                                                                                                                                • API String ID: 3172552164-1795789498
                                                                                                                                                                                                                                • Opcode ID: 0e91e8134f3f0a2acecc819678f64b06b4ac429a3b0f808dfbaf77f92b966242
                                                                                                                                                                                                                                • Instruction ID: aaad5875d2bfad25dc7031949536816c34a99ebc3cdc20d7fd32fc64c96fa8f4
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0e91e8134f3f0a2acecc819678f64b06b4ac429a3b0f808dfbaf77f92b966242
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D951A371604341AFE724DB25CC85FABB3EDBB88B08F44492EF58997180E774A909C756
                                                                                                                                                                                                                                Function 0040D470 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 164stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0040B530: InitializeCriticalSection.KERNEL32(?,429E9C66), ref: 0040B56B
                                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000), ref: 0040D596
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 0040D600
                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00400000,?,00000104), ref: 0040D545
                                                                                                                                                                                                                                  • Part of subcall function 0040B850: EnterCriticalSection.KERNEL32(?,429E9C66,00000000,?,?,00000000,?,0046B618,000000FF,0040B2F9,?,Module,?), ref: 0040B88C
                                                                                                                                                                                                                                  • Part of subcall function 0040B850: LeaveCriticalSection.KERNEL32(?), ref: 0040B8AA
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CriticalSection$Module$EnterFileHandleInitializeLeaveNamelstrlen
                                                                                                                                                                                                                                • String ID: Module$Module_Raw
                                                                                                                                                                                                                                • API String ID: 3611900445-3885325121
                                                                                                                                                                                                                                • Opcode ID: df711272708f242389b4b1deb2df23d232f3552d4697439a36665fd21275f3c4
                                                                                                                                                                                                                                • Instruction ID: b62862205e127b6a6d0f3683d3de7283ddc963d006df82214ccc1febf5a4d55a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: df711272708f242389b4b1deb2df23d232f3552d4697439a36665fd21275f3c4
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 405164729083419BC720EF55C88099FB7E5BFC8304F444E3EF589A3291DB7999498B9B
                                                                                                                                                                                                                                Function 0040B140 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 160stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0040B530: InitializeCriticalSection.KERNEL32(?,429E9C66), ref: 0040B56B
                                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000), ref: 0040B25B
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 0040B2C5
                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00400000,?,00000104), ref: 0040B20A
                                                                                                                                                                                                                                  • Part of subcall function 0040B850: EnterCriticalSection.KERNEL32(?,429E9C66,00000000,?,?,00000000,?,0046B618,000000FF,0040B2F9,?,Module,?), ref: 0040B88C
                                                                                                                                                                                                                                  • Part of subcall function 0040B850: LeaveCriticalSection.KERNEL32(?), ref: 0040B8AA
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CriticalSection$Module$EnterFileHandleInitializeLeaveNamelstrlen
                                                                                                                                                                                                                                • String ID: Module$Module_Raw
                                                                                                                                                                                                                                • API String ID: 3611900445-3885325121
                                                                                                                                                                                                                                • Opcode ID: 7a39f74388f63cd0c46d6c9badb7da099b2dbdeb920867730e91ee7ce260f822
                                                                                                                                                                                                                                • Instruction ID: 28c19b155e129076b20750a995c8f6de7703a6e581d49f223daa5bb5c231035e
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7a39f74388f63cd0c46d6c9badb7da099b2dbdeb920867730e91ee7ce260f822
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 61517F715083419BC720EF25C88599FB3E4EFC8304F54893EE589A3291DB3999498B9F
                                                                                                                                                                                                                                Function 0044EB30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$lstrcmpi
                                                                                                                                                                                                                                • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                                                                • API String ID: 1020867613-2395435937
                                                                                                                                                                                                                                • Opcode ID: 91eedea4dcc102ffa9f42a5bdb442544f281217e65f3293403db768dbb8e42ab
                                                                                                                                                                                                                                • Instruction ID: 46b0a82ce8ce661f982ad78bd00789d464f8d45012ad815fd3de3e4fd636fa9a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 91eedea4dcc102ffa9f42a5bdb442544f281217e65f3293403db768dbb8e42ab
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 714127715043858FE735CB25C891BFB77E9FF81708F04491EE58A87241EA746909CB5A
                                                                                                                                                                                                                                Function 00422750 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 113COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042281A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042285A
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked
                                                                                                                                                                                                                                • String ID: IDS_DOWNLOAD_CANCEL$IDS_TITLE
                                                                                                                                                                                                                                • API String ID: 3448037634-1248909253
                                                                                                                                                                                                                                • Opcode ID: ba66551e8baea6ef972731aae64b9e3a38fb2def86dbce768fc5792b4fd0a646
                                                                                                                                                                                                                                • Instruction ID: 2aa8256e7209d5d4275a4ed14e2ff836793b345d8d6f6e6feac9fae44cc263a5
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ba66551e8baea6ef972731aae64b9e3a38fb2def86dbce768fc5792b4fd0a646
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FE411371604740AFC310EB25EC81B5BB3E8FF84704F544A2EE45597381E778E909CB6A
                                                                                                                                                                                                                                Function 0041DA50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 103COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042D9D0: _memset.LIBCMT ref: 0042DA02
                                                                                                                                                                                                                                  • Part of subcall function 00411010: lstrlenW.KERNEL32(\liveupdatelog,429E9C66,00000000,00000000,\liveupdatelog,?,0046C8B9,000000FF,0042C659,?,?,00000000,00000000), ref: 00411058
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041DAD2
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9B72), ref: 0041DB49
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-0000000C), ref: 0041DB72
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$_memsetlstrlen
                                                                                                                                                                                                                                • String ID: /from=Installer$360
                                                                                                                                                                                                                                • API String ID: 2390558752-1834694289
                                                                                                                                                                                                                                • Opcode ID: 61f8adcdae8d81a4968aa1a96baa7a677bb02c1fef24c00f22d0a047dddc6a73
                                                                                                                                                                                                                                • Instruction ID: 3a8b976b37ca400c0f33243ae94f0c1f549c147f20a70d56a281b131f977987f
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 61f8adcdae8d81a4968aa1a96baa7a677bb02c1fef24c00f22d0a047dddc6a73
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E031E8B29087419BC700DB24D841A9FB7E8EF84768F044B2EF45557291D73CE949C7AB
                                                                                                                                                                                                                                Function 00422440 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 95COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _wcsrchr.LIBCMT ref: 0042247B
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00422505
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042252E
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$_wcsrchr
                                                                                                                                                                                                                                • String ID: %s.%s%s$.h3
                                                                                                                                                                                                                                • API String ID: 2229538054-1098092279
                                                                                                                                                                                                                                • Opcode ID: 06fcb52ee2e37564d16cfc782e7671eed958b852511372cebd4a855df7f5c84d
                                                                                                                                                                                                                                • Instruction ID: e8e37d317aaa31832322cbcd22d487fb119151b5b825cd3620b62c3f34598b7c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 06fcb52ee2e37564d16cfc782e7671eed958b852511372cebd4a855df7f5c84d
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EC31E4B16086519FC700DF29DD85A1BB7E8EB88728F144B1EF854D73D1D778D8088B9A
                                                                                                                                                                                                                                Function 0044E5B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042BA20: _vswprintf_s.LIBCMT ref: 0042BA53
                                                                                                                                                                                                                                • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000104,00000000), ref: 0044E5FE
                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32 ref: 0044E64D
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0044E69D
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CloseControlCreateDeviceFileHandle_vswprintf_s
                                                                                                                                                                                                                                • String ID: %02X%02X%02X%02X%02X%02X$\\.\%s
                                                                                                                                                                                                                                • API String ID: 2864800763-1525991222
                                                                                                                                                                                                                                • Opcode ID: 3578cc3702d6f51997dd462cb588571231885b44c3671b9cdb00447e89a43525
                                                                                                                                                                                                                                • Instruction ID: c111ad6c5764a3dd932ce7a4f04190f6873d445924cc8625d3ff4b88b40d6c0b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3578cc3702d6f51997dd462cb588571231885b44c3671b9cdb00447e89a43525
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 00213AF12083406EE334EB24DC96FFBB7ECEB88304F40491EB6D882190D278894487A6
                                                                                                                                                                                                                                Function 0044E187 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CloseControlDeviceHandle_memset_strncpy
                                                                                                                                                                                                                                • String ID: SCSIDISK
                                                                                                                                                                                                                                • API String ID: 2460871282-255126371
                                                                                                                                                                                                                                • Opcode ID: b84a5b4191314e81915189f65a5c9b971be1ff4ca8cbd4c754d925ba7030c767
                                                                                                                                                                                                                                • Instruction ID: bdbaee420b49364a9eaa6bdb86c6c5deea78faf9de311c54d3586a2ffceacccd
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b84a5b4191314e81915189f65a5c9b971be1ff4ca8cbd4c754d925ba7030c767
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 002194B46483806AF730DB15D886FAFB3D8FBD4705F40091EF68996282D7B89548C76B
                                                                                                                                                                                                                                Function 00405720 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetUserDefaultUILanguage.KERNEL32(?,?,00000000,00405BFE,?,?,?,0235D99A), ref: 00405738
                                                                                                                                                                                                                                • GetUserDefaultUILanguage.KERNEL32(?,?,00000000,00405BFE,?,?,?,0235D99A), ref: 00405745
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477BE0,00477BE0,?,?,00000000,00405BFE,?,?,?,0235D99A), ref: 004057E3
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DefaultLanguageUser$lstrlen
                                                                                                                                                                                                                                • String ID: zh-TW${G
                                                                                                                                                                                                                                • API String ID: 2645361173-1808261185
                                                                                                                                                                                                                                • Opcode ID: 9c972878d56c30c7186648f11680f95ba4256391e8eb32c96e9015e29fe4028c
                                                                                                                                                                                                                                • Instruction ID: 14f7dd915c6ab339a1d2278fafe92d866142c147f21809ad7930b3a5a754bfea
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9c972878d56c30c7186648f11680f95ba4256391e8eb32c96e9015e29fe4028c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E2115A57B081609FCA0072EFAC516E92381C7C437FF69C873F248EB2D1D66C9992666D
                                                                                                                                                                                                                                Function 004053E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 004054C0: InterlockedDecrement.KERNEL32(?), ref: 00405548
                                                                                                                                                                                                                                  • Part of subcall function 004054C0: InterlockedDecrement.KERNEL32(-0000000A), ref: 00405600
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988,00477988,00490474,default,force_lang,429E9C66,?,004904B0,00000000,0046F788,000000FF,00405945), ref: 00405494
                                                                                                                                                                                                                                  • Part of subcall function 00406BB0: InterlockedDecrement.KERNEL32(?), ref: 00406C54
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040545B
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$lstrlen
                                                                                                                                                                                                                                • String ID: appname$default$force_lang
                                                                                                                                                                                                                                • API String ID: 2495739296-2688174981
                                                                                                                                                                                                                                • Opcode ID: a950b046b27312e681cefdd9591558fc1246af9782e0476d4ba98b2a822fdbc6
                                                                                                                                                                                                                                • Instruction ID: 43fca1b7271310897c3bcaa518c4bc65beba448794138fdb323e8f8275b31e60
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a950b046b27312e681cefdd9591558fc1246af9782e0476d4ba98b2a822fdbc6
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 73110AB16487405FC600DB28DC46F9BB798EB90B25F504A3FF515D23D1E77C940486A9
                                                                                                                                                                                                                                Function 00414510 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • lstrlenA.KERNEL32(unknown,00477988,?,00415C39), ref: 00414519
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(00000001), ref: 00414540
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,unknown,000000FF,00000000,00000001,00477988,?,00415C39), ref: 00414583
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00000000), ref: 0041459C
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: lstrlen$ByteCharDecrementInterlockedMultiWide
                                                                                                                                                                                                                                • String ID: unknown
                                                                                                                                                                                                                                • API String ID: 2012122458-2904991687
                                                                                                                                                                                                                                • Opcode ID: a543c32dfd104d9a92f2e23fa7578063891da4beb52b46edf0332fd19bf8b5ac
                                                                                                                                                                                                                                • Instruction ID: 57dea18abf6d44de53565f513200821d32faa35005a7420c5b5f79bd5c4edd20
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a543c32dfd104d9a92f2e23fa7578063891da4beb52b46edf0332fd19bf8b5ac
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B4110471600202ABD720DB3DDC49A6BB7AAEF88351714453AEA15D33A0EB38DC80CB58
                                                                                                                                                                                                                                Function 0044A9D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 00414C40: GetModuleHandleW.KERNEL32(?,?), ref: 00414C5F
                                                                                                                                                                                                                                  • Part of subcall function 00414C40: GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?), ref: 00414C70
                                                                                                                                                                                                                                  • Part of subcall function 00414C40: GetModuleHandleW.KERNEL32(Kernel32.dll,AddDllDirectory,?,?), ref: 00414C9F
                                                                                                                                                                                                                                  • Part of subcall function 00414C40: GetProcAddress.KERNEL32(00000000), ref: 00414CA2
                                                                                                                                                                                                                                  • Part of subcall function 00414C40: LoadLibraryExW.KERNEL32(?,00000000,?,?,?), ref: 00414CC6
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,InitLibs), ref: 0044A9F7
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CreateObject), ref: 0044AA01
                                                                                                                                                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 0044AA4D
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AddressModuleProc$HandleLibrary$FileFreeLoadName
                                                                                                                                                                                                                                • String ID: CreateObject$InitLibs
                                                                                                                                                                                                                                • API String ID: 3415243727-2586406189
                                                                                                                                                                                                                                • Opcode ID: 929a2e0cf97fcd6c652b0651d53c628f5df894910ffe2802f36885b9f1162ed9
                                                                                                                                                                                                                                • Instruction ID: 537ac421e406c9d021821f93cd41a0d003ab5cabd7d1ed6d6d6fcf55228c2054
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 929a2e0cf97fcd6c652b0651d53c628f5df894910ffe2802f36885b9f1162ed9
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6E01A1736463249F9710EFB9AA8459FB7D8EB84761B00C43BF608D7200D734894487AA
                                                                                                                                                                                                                                Function 00455A11 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • ___BuildCatchObject.LIBCMT ref: 00455A24
                                                                                                                                                                                                                                  • Part of subcall function 0045597F: ___BuildCatchObjectHelper.LIBCMT ref: 004559B5
                                                                                                                                                                                                                                • _UnwindNestedFrames.LIBCMT ref: 00455A3B
                                                                                                                                                                                                                                • ___FrameUnwindToState.LIBCMT ref: 00455A49
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
                                                                                                                                                                                                                                • String ID: <G$csm
                                                                                                                                                                                                                                • API String ID: 2163707966-2368399712
                                                                                                                                                                                                                                • Opcode ID: 52d45c5e1f4b55804b5ab727c91f30cdb458ea97769075f0a7ac418f003b6fce
                                                                                                                                                                                                                                • Instruction ID: a63169a8c3580f6fef4124497b06307cad196543d1d362eb1de082e0390f23ad
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 52d45c5e1f4b55804b5ab727c91f30cdb458ea97769075f0a7ac418f003b6fce
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A1014B71001909BBDF12AF52CC95EEF3F6AEF1835AF004116BD0815122D73A98B6DBA8
                                                                                                                                                                                                                                Function 0042E640 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • FindResourceW.KERNEL32(00000000,000000CE,DLL,00000000,0042E1CE,00000000,00000000,00000000,?,00000000,?,ini_url_default,?,?), ref: 0042E653
                                                                                                                                                                                                                                • SizeofResource.KERNEL32(00000000,00000000,00000000,?,00000000,?,ini_url_default,?,?,?,?,?), ref: 0042E665
                                                                                                                                                                                                                                • LoadResource.KERNEL32(00000000,00000000,?,00000000,?,ini_url_default,?,?,?,?,?), ref: 0042E670
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Resource$FindLoadSizeof
                                                                                                                                                                                                                                • String ID: DLL
                                                                                                                                                                                                                                • API String ID: 507330600-2876567996
                                                                                                                                                                                                                                • Opcode ID: af5873ed47889cc1c2466214bb3f5f1928f224cee3dbad0c4cff0e03877d263c
                                                                                                                                                                                                                                • Instruction ID: 292a8328ac32892de8cdc685adae79a64f2716a483939c099d413eb603ea3336
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: af5873ed47889cc1c2466214bb3f5f1928f224cee3dbad0c4cff0e03877d263c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0AF01C716453A1AFEB601B7ABC48B937B98FB15761F104562F50DCA664D37488C086A8
                                                                                                                                                                                                                                Function 00402F70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26registryCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00402F84
                                                                                                                                                                                                                                • GetClassInfoExW.USER32(?,#32770), ref: 00402F96
                                                                                                                                                                                                                                • RegisterClassExW.USER32(00000000), ref: 00402FB4
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Class$InfoRegister_memset
                                                                                                                                                                                                                                • String ID: #32770$0
                                                                                                                                                                                                                                • API String ID: 735845640-1329935265
                                                                                                                                                                                                                                • Opcode ID: 7b25498dafe7693e7588848dae65b121d2ebaa884c746ae581497a3d2c240560
                                                                                                                                                                                                                                • Instruction ID: 9aa4027d4f2f41c6930409ae3f0d92064f8fc787c4de39ed6c1b275c722f5fdb
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7b25498dafe7693e7588848dae65b121d2ebaa884c746ae581497a3d2c240560
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AEE030B4915311AFE344DF14DC45B6EBBE8AB94744F80882EF898C2190E6BC92088B96
                                                                                                                                                                                                                                Function 004553A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 004553BA
                                                                                                                                                                                                                                  • Part of subcall function 00456D76: __getptd_noexit.LIBCMT ref: 00456D79
                                                                                                                                                                                                                                  • Part of subcall function 00456D76: __amsg_exit.LIBCMT ref: 00456D86
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 004553CB
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 004553D9
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                                                                                                                                                                                • String ID: MOC$csm
                                                                                                                                                                                                                                • API String ID: 803148776-1389381023
                                                                                                                                                                                                                                • Opcode ID: ab64303db8208a563308f1aec09bfb8565b7d4f73f5ab9996c49f9487a2e41b6
                                                                                                                                                                                                                                • Instruction ID: e6ada8a37885ef80ec3dfd3ca895576d297fd3ef3227f724de035184e530bc08
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ab64303db8208a563308f1aec09bfb8565b7d4f73f5ab9996c49f9487a2e41b6
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 44E01A32604A449FC710AB65C186B2933B4AB4631AF5644AAEC0CC7323D76DD898954B
                                                                                                                                                                                                                                Function 00444D10 Relevance: 7.7, APIs: 5, Instructions: 214fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetFileSizeEx.KERNEL32(?,?,?,?,?,00000000,00000002,00443720,?,?,?,?,?,?,?,?), ref: 00444D29
                                                                                                                                                                                                                                • SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00444DB9
                                                                                                                                                                                                                                • ReadFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?), ref: 00444DD5
                                                                                                                                                                                                                                • SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00444E61
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: File$Pointer$ReadSize
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1971422761-0
                                                                                                                                                                                                                                • Opcode ID: 583f7306af57259675c800594112e9483eb7c23f7190967a0577b6044b19dcd6
                                                                                                                                                                                                                                • Instruction ID: 15ad3163ec83dfc4aae23265db9332d58fcb5f4b1d404308a3dd8a4749652d41
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 583f7306af57259675c800594112e9483eb7c23f7190967a0577b6044b19dcd6
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7361B0B1B042015BE310DA69DC40B6BB7E8FBC5714F54446EF948DB380DA2AEC058BA6
                                                                                                                                                                                                                                Function 00406440 Relevance: 7.7, APIs: 5, Instructions: 186stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00406455
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988,?,?,?,?,?,?,?,?,?,?,?), ref: 0040646E
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(771AE0B0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004064B3
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040653F
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040661B
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: lstrlen$DecrementInterlocked
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 450581559-0
                                                                                                                                                                                                                                • Opcode ID: 8a2ea50d5ae7648e96953404fef74d6725bbe59b151b04c50c4c80e730c8e0f4
                                                                                                                                                                                                                                • Instruction ID: 38802204a88bf3c64ca2bc86e84eb77c710fd5c6b84e9a33ca13c1b08baa7861
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8a2ea50d5ae7648e96953404fef74d6725bbe59b151b04c50c4c80e730c8e0f4
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AE51DF716003019FC710EF28DC8495BB7E5FF84358F094A3EE846A7355E738EA598BA9
                                                                                                                                                                                                                                Function 00429220 Relevance: 7.6, APIs: 5, Instructions: 116stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,429E9C66,?,?,?,00000000,?,00000000,0046C5A8,000000FF,0040142C), ref: 0042927B
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?,00000000,?,00000000,?,00000000,0046C5A8,000000FF,0040142C,00000000,?), ref: 004292BE
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004292DB
                                                                                                                                                                                                                                  • Part of subcall function 0040E320: InterlockedDecrement.KERNEL32(-0000000C), ref: 0040E337
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,00000000,?,00000000,0046C5A8,000000FF,0040142C,00000000,?), ref: 0042931B
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00429347
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$ByteCharMultiWide$lstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2282037674-0
                                                                                                                                                                                                                                • Opcode ID: e5f86216318302718f2f0b61c41f6034921791e633c52d09363bd0c2e69b5daf
                                                                                                                                                                                                                                • Instruction ID: 6d3a917486c9e86decb4275e3de193a6c5113cb277fed3dafb45915ba282e4f2
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e5f86216318302718f2f0b61c41f6034921791e633c52d09363bd0c2e69b5daf
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B84106727042519FD310DF19EC41B6BB7A8FB88764F540A2EFC0597390D738AD448BAA
                                                                                                                                                                                                                                Function 00423AA0 Relevance: 7.6, APIs: 5, Instructions: 114stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00423AE9
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(-0000000C), ref: 00423B47
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00000000), ref: 00423B59
                                                                                                                                                                                                                                  • Part of subcall function 0040E540: InterlockedDecrement.KERNEL32(-0000000C), ref: 0040E55B
                                                                                                                                                                                                                                • MulDiv.KERNEL32(0000000E,00000000), ref: 00423BAA
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00423BEA
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$Increment_memsetlstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2156533356-0
                                                                                                                                                                                                                                • Opcode ID: 81aca05b193212c5c4b3581901d8b63b891f5eb8ea6501ec9af9af5644e97648
                                                                                                                                                                                                                                • Instruction ID: 53a97a95eff549672f15c93871fdbfd7f928e30d9e2ee410b2c67f86079078e9
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 81aca05b193212c5c4b3581901d8b63b891f5eb8ea6501ec9af9af5644e97648
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0D41E1B16087809FD310DF64DC85B5BBBE4FB48715F400E2EF559932A1E778A908CB9A
                                                                                                                                                                                                                                Function 004478B0 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetProcessHeap.KERNEL32(429E9C66), ref: 004478DC
                                                                                                                                                                                                                                • HeapLock.KERNEL32(00000000), ref: 00447902
                                                                                                                                                                                                                                • HeapWalk.KERNEL32(00000000,?), ref: 0044791C
                                                                                                                                                                                                                                • HeapWalk.KERNEL32(00000000,?), ref: 0044795F
                                                                                                                                                                                                                                • HeapUnlock.KERNEL32(00000000), ref: 00447977
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Heap$Walk$LockProcessUnlock
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2227978497-0
                                                                                                                                                                                                                                • Opcode ID: d17ff166919c4de0687fe7577c81fed61e7dc156618cde6dc8abc71742c8a951
                                                                                                                                                                                                                                • Instruction ID: 71b007622ce9e804cdaf0ff51fdebba380479bdb0de9e5bc18c9c2d9f32a2e81
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d17ff166919c4de0687fe7577c81fed61e7dc156618cde6dc8abc71742c8a951
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8F219EB65083529FF710CF19C884B9BBBE4EB89760F404A2FE95493360D3389846CB5A
                                                                                                                                                                                                                                Function 0042BA80 Relevance: 7.6, APIs: 5, Instructions: 77stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988,00477988,429E9C66,?,?,?,00000000,00000000,0046BBEC,000000FF,0041663C,?,?,?,429E9C66,0048F134), ref: 0042BAF8
                                                                                                                                                                                                                                  • Part of subcall function 0040E540: InterlockedDecrement.KERNEL32(-0000000C), ref: 0040E55B
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988,00477988,?,00000000,00000000,0046BBEC,000000FF,0041663C,?,?,?,429E9C66,0048F134,006C1D00,00000000,?), ref: 0042BB0B
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988,00477988,?,00000000,00000000,0046BBEC,000000FF,0041663C,?,?,?,429E9C66,0048F134,006C1D00,00000000,?), ref: 0042BB21
                                                                                                                                                                                                                                • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,0046BBEC,000000FF,0041663C,?,?,?,429E9C66,0048F134,006C1D00), ref: 0042BB37
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00477988,00477988,?,00000000,00000000,0046BBEC,000000FF,0041663C,?,?,?,429E9C66,0048F134,006C1D00,00000000,?), ref: 0042BB61
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: lstrlen$CreateDecrementEventInterlocked
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2923493257-0
                                                                                                                                                                                                                                • Opcode ID: 270685cbfab46b4287647d0b74721606697b72779b2492ec59564f5eaf84197e
                                                                                                                                                                                                                                • Instruction ID: 0eccc1ddc64aa418525417edb99ebe142bc779c63fe023fd60a1541003da3e3a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 270685cbfab46b4287647d0b74721606697b72779b2492ec59564f5eaf84197e
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F6316CF1615751ABC300CF2ADC01A85FBE4FB08B14F108A2AA61893B80D778B955CBE9
                                                                                                                                                                                                                                Function 00410020 Relevance: 7.6, APIs: 5, Instructions: 74COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(00421EB6), ref: 00410039
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-000000F4), ref: 00410060
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00410087
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004100AE
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004100D5
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3448037634-0
                                                                                                                                                                                                                                • Opcode ID: a49a75c1886e5623b5d6b79e256d858aee50cb513aa817e7d0c76c2fa37d76fc
                                                                                                                                                                                                                                • Instruction ID: 70d128e114fed55e2ce47e25e9f5d0e92945c466203a8072bdaa7c28404afbe4
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a49a75c1886e5623b5d6b79e256d858aee50cb513aa817e7d0c76c2fa37d76fc
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EE210AF2901A064FC220FA3DEC95E5BB779EF50714314CB19E42187696EB78E8C98754
                                                                                                                                                                                                                                Function 00404D40 Relevance: 7.6, APIs: 5, Instructions: 74stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00404D66
                                                                                                                                                                                                                                • GetTempPathW.KERNEL32(00000400,?,?,?,?), ref: 00404D7E
                                                                                                                                                                                                                                  • Part of subcall function 00404BA0: _memset.LIBCMT ref: 00404BC6
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00404DAB
                                                                                                                                                                                                                                • GetTempPathW.KERNEL32(00000400,?,?,?,?,?,?,?), ref: 00404DBD
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,?), ref: 00404DEC
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$PathTemp$lstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 824320180-0
                                                                                                                                                                                                                                • Opcode ID: acf67df62bac88be1c07b893f6993388542547204f0b3d69f1df966bd6bf4486
                                                                                                                                                                                                                                • Instruction ID: 53095fc7b556232e698477e66e31a9d17b11de332024bd53b31b2617e7156a52
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: acf67df62bac88be1c07b893f6993388542547204f0b3d69f1df966bd6bf4486
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 761184B16143416BD310EB65DC46B6B73A8BFC4745F044C3EF744971C0EA74E90887AA
                                                                                                                                                                                                                                Function 0042B4C0 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,0041675D,429E9C66,00474B04,00000000,?,00000000,?,00000000,0046B9BC,000000FF,0040318E,?,?), ref: 0042B4D2
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042B4F0
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042B517
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042B53E
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042B565
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$CloseHandle
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 386936172-0
                                                                                                                                                                                                                                • Opcode ID: 3e787b1474436ee89bd8ff3a4a9d2fb0283a79a9736c08aea2f1dda4367dff72
                                                                                                                                                                                                                                • Instruction ID: 776b08e731efafe0fb4bf15605c305d36f1e70769ccbeacf25b9d9c024ee3bf4
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3e787b1474436ee89bd8ff3a4a9d2fb0283a79a9736c08aea2f1dda4367dff72
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5011BEF2601A065FC714AA3DEC85D2BB3B8EF40714314CB1DE42587795EB38E8498798
                                                                                                                                                                                                                                Function 0042BBB0 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,0041137F), ref: 0042BBC2
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042BBE0
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042BC07
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042BC2E
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0042BC55
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$CloseHandle
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 386936172-0
                                                                                                                                                                                                                                • Opcode ID: cb4150173fae5b37fdb8d4af2abc28c77d02b53f841c9b314dc0e4b6f98785fc
                                                                                                                                                                                                                                • Instruction ID: 329b30c2f824296616ad96067e3da7d4f4d6aa35081f37ada5dbbb802179c803
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: cb4150173fae5b37fdb8d4af2abc28c77d02b53f841c9b314dc0e4b6f98785fc
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C711A8F2601A454FC624AA3EEC89D1BB3B9EF907143148B1EE42587795EB38E8498694
                                                                                                                                                                                                                                Function 00429080 Relevance: 7.6, APIs: 5, Instructions: 65processCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 00413EB0: InterlockedDecrement.KERNEL32(00000000), ref: 00413ECF
                                                                                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004290AB
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004290DE
                                                                                                                                                                                                                                • Process32FirstW.KERNEL32 ref: 004290F6
                                                                                                                                                                                                                                • Process32NextW.KERNEL32(00000000,?), ref: 0042910C
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0042911C
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Process32$CloseCreateDecrementFirstHandleInterlockedNextSnapshotToolhelp32_memset
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1131098292-0
                                                                                                                                                                                                                                • Opcode ID: 43bb094bf81b1cabf094f61995bcb47ad1a1b89e92325ec1945584221a64b41e
                                                                                                                                                                                                                                • Instruction ID: 1a20a3ea7a74f1f495ee463c6366b00fd42956051ae19a75ff190e5718657180
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 43bb094bf81b1cabf094f61995bcb47ad1a1b89e92325ec1945584221a64b41e
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3211CB3170535057E220AB65AC9A77FB395DF88314F94492FF90583181DB3C9D05869A
                                                                                                                                                                                                                                Function 0041F9E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0041FA18
                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,00000800,00000800,?,?,0041FB97,00000000,00000000,429E9C66), ref: 0041FA37
                                                                                                                                                                                                                                • PathRemoveFileSpecW.SHLWAPI(00000000,?,?,0041FB97,00000000,00000000,429E9C66), ref: 0041FA41
                                                                                                                                                                                                                                • _wcsncpy.LIBCMT ref: 0041FA61
                                                                                                                                                                                                                                • _wcsncpy.LIBCMT ref: 0041FA8A
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: File_wcsncpy$ModuleNamePathRemoveSpec_memset
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3703674242-0
                                                                                                                                                                                                                                • Opcode ID: b5d52b126700394ed1dde11f587abf4e8fd2e06ae4dda35d1f673187db3b6f93
                                                                                                                                                                                                                                • Instruction ID: 75af04385e576b7015250757713d420b17a7314fea5e22841416876ea43eaa77
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b5d52b126700394ed1dde11f587abf4e8fd2e06ae4dda35d1f673187db3b6f93
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B411EE72A102406BD325AB24DC16FEF73A9AF8C746F80483EB64DC61D1EA7C9548C75E
                                                                                                                                                                                                                                Function 00429180 Relevance: 7.5, APIs: 5, Instructions: 48processCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00429199
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004291B1
                                                                                                                                                                                                                                • Process32FirstW.KERNEL32 ref: 004291C7
                                                                                                                                                                                                                                • Process32NextW.KERNEL32(00000000,?), ref: 004291DC
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 004291E6
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2526126748-0
                                                                                                                                                                                                                                • Opcode ID: b7e6ae39357a4a3fad3530299eb9a2dc553667309e7de3a23daf7d10a2505a98
                                                                                                                                                                                                                                • Instruction ID: b53ccc8cd24344fb2499c393913c1c7631d7cb1849c0036fa9c1556988797201
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b7e6ae39357a4a3fad3530299eb9a2dc553667309e7de3a23daf7d10a2505a98
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4801D1315152106BF224AB75DC5AB6F73E4AF48314F848A1EF868821C1E73C9905C79B
                                                                                                                                                                                                                                Function 00404610 Relevance: 7.5, APIs: 5, Instructions: 42threadCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(0048D7B8), ref: 00404619
                                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00404629
                                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(0048D7B8), ref: 00404644
                                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(0048D7B8), ref: 00404662
                                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(0048D7B8), ref: 0040467A
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CriticalSection$Leave$CurrentEnterThread
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2905768538-0
                                                                                                                                                                                                                                • Opcode ID: faf87205020a8802d24eda51286a92be9ead9b99f0d46c9eb2bc862458047450
                                                                                                                                                                                                                                • Instruction ID: b6ed3bd1c7b21de22eda44f37d38fca40cc79b8b53176c14bef9aacc1a98ce4a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: faf87205020a8802d24eda51286a92be9ead9b99f0d46c9eb2bc862458047450
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E3016235B012608BCB205B59F84495E77A1EFC5B31315483FE94AD37A4D6389CC58B98
                                                                                                                                                                                                                                Function 004507F0 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 00452D4C: _doexit.LIBCMT ref: 00452D58
                                                                                                                                                                                                                                • ___set_flsgetvalue.LIBCMT ref: 00450802
                                                                                                                                                                                                                                  • Part of subcall function 00456B88: TlsGetValue.KERNEL32(?,00450807), ref: 00456B91
                                                                                                                                                                                                                                  • Part of subcall function 00456B88: __decode_pointer.LIBCMT ref: 00456BA3
                                                                                                                                                                                                                                  • Part of subcall function 00456B88: TlsSetValue.KERNEL32(00000000,00450807), ref: 00456BB2
                                                                                                                                                                                                                                • ___fls_getvalue@4.LIBCMT ref: 0045080D
                                                                                                                                                                                                                                  • Part of subcall function 00456B68: TlsGetValue.KERNEL32(?,?,00450812,00000000), ref: 00456B76
                                                                                                                                                                                                                                • ___fls_setvalue@8.LIBCMT ref: 00450820
                                                                                                                                                                                                                                  • Part of subcall function 00456BBC: __decode_pointer.LIBCMT ref: 00456BCD
                                                                                                                                                                                                                                • GetLastError.KERNEL32(00000000,?,00000000), ref: 00450829
                                                                                                                                                                                                                                • ExitThread.KERNEL32 ref: 00450830
                                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00450836
                                                                                                                                                                                                                                • __freefls@4.LIBCMT ref: 00450856
                                                                                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00450869
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 132634196-0
                                                                                                                                                                                                                                • Opcode ID: 8c5adf9b6fc21f4468b82f5b79147d3771b7ecdd8fa708ff5164188ff0258c02
                                                                                                                                                                                                                                • Instruction ID: c5cbb237fbc06bce22417a9f505853df6aa53f1b788aa44351aee2186c77f30e
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8c5adf9b6fc21f4468b82f5b79147d3771b7ecdd8fa708ff5164188ff0258c02
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A9E04F35C00228678F103BF68C0AD9F3A2C9D4535AB92401ABE08D7123DA3CA95986ED
                                                                                                                                                                                                                                Function 0040A400 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 283COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040A478
                                                                                                                                                                                                                                  • Part of subcall function 00453FBC: RaiseException.KERNEL32(?,?,0044FE91,?,?,?,?,?,0044FE91,?,0047F018,0048E270), ref: 00453FFE
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040A6C3
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040A6EA
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • invalid map/set<T> iterator, xrefs: 0040A435
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$ExceptionException@8RaiseThrow
                                                                                                                                                                                                                                • String ID: invalid map/set<T> iterator
                                                                                                                                                                                                                                • API String ID: 1469470630-152884079
                                                                                                                                                                                                                                • Opcode ID: bb6320ad5a75189c1d6ace7d9ac7b013c7a39c728d2b94e0818f4b5be43f5876
                                                                                                                                                                                                                                • Instruction ID: 83f1519b58ead39c0d7fbd07f1d41d9e004650a802bd8687654a90ad5b56700f
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bb6320ad5a75189c1d6ace7d9ac7b013c7a39c728d2b94e0818f4b5be43f5876
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9EC1B074509380AFC715CF28C454A2BBFE1AF55304F2885AEE4855B392D339EC96CB97
                                                                                                                                                                                                                                Function 00441780 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 270COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 004204C0: std::_Lockit::_Lockit.LIBCPMT ref: 004204CF
                                                                                                                                                                                                                                  • Part of subcall function 004424B0: std::_Lockit::_Lockit.LIBCPMT ref: 004424DB
                                                                                                                                                                                                                                  • Part of subcall function 0041FF70: std::_Lockit::_Lockit.LIBCPMT ref: 0041FF7E
                                                                                                                                                                                                                                • numpunct.LIBCPMTD ref: 004417F8
                                                                                                                                                                                                                                • _memmove_s.LIBCMT ref: 00441909
                                                                                                                                                                                                                                • std::ios_base::width.LIBCPMTD ref: 00441A84
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: LockitLockit::_std::_$_memmove_snumpunctstd::ios_base::width
                                                                                                                                                                                                                                • String ID: @
                                                                                                                                                                                                                                • API String ID: 2402335362-2766056989
                                                                                                                                                                                                                                • Opcode ID: d6752bd6cf7b423af17c3ebc9aaf98be774e7d7c8e9e762fea5c08128f9c9621
                                                                                                                                                                                                                                • Instruction ID: 91f73491aaef3ce16c48d10c7a8e353f72cd22280981d7f6dbf609923f35b782
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d6752bd6cf7b423af17c3ebc9aaf98be774e7d7c8e9e762fea5c08128f9c9621
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6EC147B19001499FDB04DF99C890AEEBBB5BF48304F14825EF919A7361DB38AE41CF94
                                                                                                                                                                                                                                Function 004493E0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 194COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                • String ID: IEXPLORE.EXE$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s$`H
                                                                                                                                                                                                                                • API String ID: 2102423945-3010079524
                                                                                                                                                                                                                                • Opcode ID: 748a82e95319125277c40a664ab89fe1963c1d756066fb9c17350a76a7251146
                                                                                                                                                                                                                                • Instruction ID: 3199e2880a137101d727f562787b16cdbb1ca18f082bc21c22c5ec30de99ee70
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 748a82e95319125277c40a664ab89fe1963c1d756066fb9c17350a76a7251146
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CE71AA712083418FE314CF28C885A6BB7E5FFC9324F148A1EF4A987291D775E805CB9A
                                                                                                                                                                                                                                Function 0042B060 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memmove_s
                                                                                                                                                                                                                                • String ID: x.l
                                                                                                                                                                                                                                • API String ID: 800865076-3936404645
                                                                                                                                                                                                                                • Opcode ID: ec13e75f447a93c6e5ec73a97583c6672cdcc9ba59835554abadbbce36fff425
                                                                                                                                                                                                                                • Instruction ID: 754d12a55f82e4d2cc8d158d9cd26561bb1c7817b21702e6f7df0b8396a49a72
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ec13e75f447a93c6e5ec73a97583c6672cdcc9ba59835554abadbbce36fff425
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C051D1727003058F8724DE78ED8593BB3A6EB84351B048A3EE962C7385EB75FD098795
                                                                                                                                                                                                                                Function 004408B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 160COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: swprintf
                                                                                                                                                                                                                                • String ID: $$$$l
                                                                                                                                                                                                                                • API String ID: 233258989-1469801561
                                                                                                                                                                                                                                • Opcode ID: a5aad979adc9f6bfec9c41f7258252e5bfac7dfe6b3648a08cb8235c3c1df6ea
                                                                                                                                                                                                                                • Instruction ID: 6ccb1f8d04a2ebe9d6b50542357c60a578cefbad91f695c788bf7afdfb5db178
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a5aad979adc9f6bfec9c41f7258252e5bfac7dfe6b3648a08cb8235c3c1df6ea
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F3617EB090020DDBEF14DF54D954BEE77B4FF44304F40809AEA9862282CB389AB5CF1A
                                                                                                                                                                                                                                Function 00440AF0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 154COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: swprintf
                                                                                                                                                                                                                                • String ID: $$$$l
                                                                                                                                                                                                                                • API String ID: 233258989-1469801561
                                                                                                                                                                                                                                • Opcode ID: 39ba66887754ecc1a7fa3fead66e563ef52e7ad1b0ddbb46e56ec4467de75409
                                                                                                                                                                                                                                • Instruction ID: 06d7821d8f0c91ec08c45dd33706f5be03f1a283f518f776439662866c0ab48b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 39ba66887754ecc1a7fa3fead66e563ef52e7ad1b0ddbb46e56ec4467de75409
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C0518F7090060DDFEF14DF95D994BAEB7B4FF44304F00819AEA58A6241CB389AB5CF59
                                                                                                                                                                                                                                Function 004195C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 127COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedIncrement.KERNEL32(00000000), ref: 00405119
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedDecrement.KERNEL32(-0000000C), ref: 00405155
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004196F2
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00419714
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$Increment
                                                                                                                                                                                                                                • String ID: IDS_PRODUCT_NAME$PNG
                                                                                                                                                                                                                                • API String ID: 2574743344-3739555457
                                                                                                                                                                                                                                • Opcode ID: 9c753065f00079d215ad1d52e6eac7d9681edc36667498d3919aaee132912ec1
                                                                                                                                                                                                                                • Instruction ID: b0700b2b2e6c6091355d46076bc2fbb6f3a1d3560986ddc65dcee78d8644786f
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9c753065f00079d215ad1d52e6eac7d9681edc36667498d3919aaee132912ec1
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AC41A1B1601700AFD210EB25DC42F6BB3E8FF88B04F00492DFA549B2D1D779B9458BA9
                                                                                                                                                                                                                                Function 00426670 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000000,0000000D), ref: 004266B0
                                                                                                                                                                                                                                • FlushInstructionCache.KERNEL32(00000000), ref: 004266B7
                                                                                                                                                                                                                                  • Part of subcall function 0044CF2B: GetProcessHeap.KERNEL32(00000000,0000000D,00000000,0040474E,?,?,00419E8C,?,00418F76,00000000), ref: 0044CEAC
                                                                                                                                                                                                                                  • Part of subcall function 0044CF2B: HeapAlloc.KERNEL32(00000000,?,00419E8C,?,00418F76,00000000), ref: 0044CEB3
                                                                                                                                                                                                                                • SetLastError.KERNEL32(0000000E), ref: 00426732
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: HeapProcess$AllocCacheCurrentErrorFlushInstructionLast
                                                                                                                                                                                                                                • String ID: OCB
                                                                                                                                                                                                                                • API String ID: 943407966-3338743701
                                                                                                                                                                                                                                • Opcode ID: 164847cc2d2e133ee7563525988562fd4664f01023e1301f48cf68ac96e48405
                                                                                                                                                                                                                                • Instruction ID: 86c119cf1fa5ed84737c07a0213baedc63e2cb59fee13100be99ca11ee512cd1
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 164847cc2d2e133ee7563525988562fd4664f01023e1301f48cf68ac96e48405
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BB216072600251AFD310EF69E908F6BB7E9EBC4710F06852AF549A7391C774EC40CBA5
                                                                                                                                                                                                                                Function 004423C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 004423EB
                                                                                                                                                                                                                                  • Part of subcall function 0041FE90: std::_Lockit::_Lockit.LIBCPMT ref: 0041FE9C
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: LockitLockit::_std::_
                                                                                                                                                                                                                                • String ID: bad cast
                                                                                                                                                                                                                                • API String ID: 3382485803-3145022300
                                                                                                                                                                                                                                • Opcode ID: a3cd0151b3d4a55232aadddf1a1934f069871c662e865498b29399e4c281c644
                                                                                                                                                                                                                                • Instruction ID: 9be26b10e1d4052c909fc56292394f7783714b20e0296c2ff5ec05a3083d097a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a3cd0151b3d4a55232aadddf1a1934f069871c662e865498b29399e4c281c644
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 51315C71D102099FDB04DFA8C941AEEB7B4FF08314F50862BF825A3390DB785A06CB99
                                                                                                                                                                                                                                Function 004424B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 004424DB
                                                                                                                                                                                                                                  • Part of subcall function 0041FE90: std::_Lockit::_Lockit.LIBCPMT ref: 0041FE9C
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: LockitLockit::_std::_
                                                                                                                                                                                                                                • String ID: bad cast
                                                                                                                                                                                                                                • API String ID: 3382485803-3145022300
                                                                                                                                                                                                                                • Opcode ID: 30098ea4c342a1b2ca3e1d2a4e4c3bdfc563a34bdd7943f1cd8b04f9810d5f13
                                                                                                                                                                                                                                • Instruction ID: bba7a2e1535d3629ef8a9b60c4bace2e65ba5eaaac8d2d26bb271427edfffbc8
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 30098ea4c342a1b2ca3e1d2a4e4c3bdfc563a34bdd7943f1cd8b04f9810d5f13
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DE315E71D002099FDB04DF98D941BEEB7B4FB08314F50822BF825A3390EB785A06CB99
                                                                                                                                                                                                                                Function 0045C21B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __calloc_crt
                                                                                                                                                                                                                                • String ID: H|H$X|H
                                                                                                                                                                                                                                • API String ID: 3494438863-1218019947
                                                                                                                                                                                                                                • Opcode ID: b3ae0e96934968a7d11001c5022122b2b360851891e12c1c4005fff1c3636480
                                                                                                                                                                                                                                • Instruction ID: 1c05b27bf772673bbea67d1621bc4e435e4a80b9c5bb1d434b5aba38141093f1
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b3ae0e96934968a7d11001c5022122b2b360851891e12c1c4005fff1c3636480
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E5112731B087115FE7249A9E7CE02692791B79477AF24467FF901CB3A1E738C885464C
                                                                                                                                                                                                                                Function 004050C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 004088C0: InterlockedDecrement.KERNEL32(0048B90C), ref: 004089B1
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(00000000), ref: 00405119
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-0000000C), ref: 00405155
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$Increment
                                                                                                                                                                                                                                • String ID: IDS_QUIT
                                                                                                                                                                                                                                • API String ID: 2574743344-2274791611
                                                                                                                                                                                                                                • Opcode ID: f5f7a50d1750b74208f6d7c3c5cece506e85c294dab1330d429fb8e383fe8117
                                                                                                                                                                                                                                • Instruction ID: 11d22c365bd92b51ae49f6409b8828d434c04b4ebd185e9c04da8b369f175754
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f5f7a50d1750b74208f6d7c3c5cece506e85c294dab1330d429fb8e383fe8117
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9211ACB2A04A51AFD300DB19C845B5BB3E8FB04314F40882EF455AB390D73CA809CFAA
                                                                                                                                                                                                                                Function 00444230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51timeCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _swscanf.LIBCMT ref: 0044426D
                                                                                                                                                                                                                                  • Part of subcall function 00456134: _vscan_fn.LIBCMT ref: 0045614B
                                                                                                                                                                                                                                • SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00443380,00000000,00000000,00000000,00000000), ref: 0044428F
                                                                                                                                                                                                                                • LocalFileTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00443380,00000000,00000000,00000000,00000000), ref: 004442A2
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • %hu-%hu-%hu %hu:%hu:%hu, xrefs: 00444267
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Time$File$LocalSystem_swscanf_vscan_fn
                                                                                                                                                                                                                                • String ID: %hu-%hu-%hu %hu:%hu:%hu
                                                                                                                                                                                                                                • API String ID: 3712118799-1004895946
                                                                                                                                                                                                                                • Opcode ID: 8fcfd65fae2f34d077862616a3bc67ada685bcf4fa987c2e509bd372da40f3f2
                                                                                                                                                                                                                                • Instruction ID: f498623a41c5c8063b741c120869efdb29c91c06d21c130dcdce015692c1baec
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8fcfd65fae2f34d077862616a3bc67ada685bcf4fa987c2e509bd372da40f3f2
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8111FEB2508301AFD755DFA9C980A9BB7E8BBDC740F444E1EF199C2210E774D648CB52
                                                                                                                                                                                                                                Function 00448350 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • \, xrefs: 004483C6
                                                                                                                                                                                                                                • SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\QHSafeMain.exe, xrefs: 00448394
                                                                                                                                                                                                                                • Path, xrefs: 0044838F
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                • String ID: Path$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\QHSafeMain.exe$\
                                                                                                                                                                                                                                • API String ID: 2102423945-2565905435
                                                                                                                                                                                                                                • Opcode ID: 028533bbedfb190c87d9ee0f314d9e0cff5c5cad6cba783fed5cc97a5b7a73d4
                                                                                                                                                                                                                                • Instruction ID: 3ff7f5950a98a310133a0d178a3ede22902279eb67bc22110aa6776a359b5b77
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 028533bbedfb190c87d9ee0f314d9e0cff5c5cad6cba783fed5cc97a5b7a73d4
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0D118A705183009AF314DF14D859BAFB7E4AF94B04F10CC2EF559C6191DB799544C78B
                                                                                                                                                                                                                                Function 00405FB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • CreateFileW.KERNEL32 ref: 00405FD0
                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,0022204C,00000000,00000004,00000000,00000004,00000003,00000000), ref: 00406000
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00406009
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                                                • String ID: \\.\360SelfProtection
                                                                                                                                                                                                                                • API String ID: 33631002-936859468
                                                                                                                                                                                                                                • Opcode ID: ce47355b92dccf8370b318fd3507fdf687972118f4ad35d1e237c12a756dcd91
                                                                                                                                                                                                                                • Instruction ID: c16841678e843b6358fb47b4095d9014b4a8752c0b70f2eb9d5d55ed87f4aef3
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ce47355b92dccf8370b318fd3507fdf687972118f4ad35d1e237c12a756dcd91
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3CF09C3169435077E210E668FC06FDB3694BB84B11F444625F754E61D0D3B8964CC7A6
                                                                                                                                                                                                                                Function 00462B35 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetModuleHandleA.KERNEL32(KERNEL32,00454078), ref: 00462B3A
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00462B4A
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                • String ID: IsProcessorFeaturePresent$KERNEL32
                                                                                                                                                                                                                                • API String ID: 1646373207-3105848591
                                                                                                                                                                                                                                • Opcode ID: 225995fc285fbdc2154967b087b00fc0161fe7f15fe2617e75f27b1890fc2a6d
                                                                                                                                                                                                                                • Instruction ID: afa7d22e2ce8f544a38e95a9adf2802ef553884fa751e1fb9cd46fde0bead16f
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 225995fc285fbdc2154967b087b00fc0161fe7f15fe2617e75f27b1890fc2a6d
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0DF03030A00E09E2DF001FA5AD0A7AF7B78FB81B42F910591D5D6B0094DFB495B5E29B
                                                                                                                                                                                                                                Function 00428D20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,00428E88,00000000), ref: 00428D2E
                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,AttachConsole), ref: 00428D3E
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                • String ID: AttachConsole$kernel32.dll
                                                                                                                                                                                                                                • API String ID: 1646373207-3937112332
                                                                                                                                                                                                                                • Opcode ID: 8219160aec947007c9fd5d802c3f71928edbac595d21a67546e426d9f98a8dbc
                                                                                                                                                                                                                                • Instruction ID: 5278a8b70d968bffcd543a03779a1522f0cb58bfe2056c219b0e1f756760ab37
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8219160aec947007c9fd5d802c3f71928edbac595d21a67546e426d9f98a8dbc
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 28E08CB03222409B97008F71EC45A1B33A46A70781744883FB809E22A0DF3CCC84EA2C
                                                                                                                                                                                                                                Function 0041F520 Relevance: 6.3, APIs: 4, Instructions: 335COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: c04a829af85dee1ebecd98ba57f720a35adeab7a5ecc202cde50c36158dc5443
                                                                                                                                                                                                                                • Instruction ID: 0b8b1cbcc51a558a193a860e0fe383979b715ebe8a00e062f0c8f7d1313dbd93
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c04a829af85dee1ebecd98ba57f720a35adeab7a5ecc202cde50c36158dc5443
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9CD14B756083069FC314CF68C984A6BBBF5BF88300F04892DF99A87355D734E84ACB66
                                                                                                                                                                                                                                Function 00417C50 Relevance: 6.3, APIs: 4, Instructions: 335COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                • Opcode ID: 5cb0b2e9ca6acee878ce285948a14c7169c2593baee871c681959495bcee28b1
                                                                                                                                                                                                                                • Instruction ID: 565f3c7ec7ec0207f80ab8a91aceac0232900a374904f122125c4888d4906f9c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5cb0b2e9ca6acee878ce285948a14c7169c2593baee871c681959495bcee28b1
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 32D138752083069FC714CF68C984A6BBBF5BF88700F04892EF99A87354D774E949CB66
                                                                                                                                                                                                                                Function 0040C1B0 Relevance: 6.3, APIs: 4, Instructions: 267stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0040BFB0: lstrcmpiW.KERNEL32(?,?,?,?,0040C235,?,429E9C66,00000000,?,00000000), ref: 0040C029
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,00000000), ref: 0040C28E
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: lstrcmpilstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3649823140-0
                                                                                                                                                                                                                                • Opcode ID: 2a5889dba0d5a8916f72790b817a0ad605abf4e9785d8541927b40b7341a3cfd
                                                                                                                                                                                                                                • Instruction ID: 4372f1aeab44e30cc96ac6b0f140e496e2876a01c16763645c11a7348686a555
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2a5889dba0d5a8916f72790b817a0ad605abf4e9785d8541927b40b7341a3cfd
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 05A18371A00248DBDB24DF55CCD1AEE73B4FF48704F10863BE905E7291E7789A458BA9
                                                                                                                                                                                                                                Function 0040BBD0 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 252stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,429E9C66), ref: 0040BC26
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: lstrlen
                                                                                                                                                                                                                                • String ID: }}$HKCR$HKCU{Software{Classes
                                                                                                                                                                                                                                • API String ID: 1659193697-1142484189
                                                                                                                                                                                                                                • Opcode ID: 58f382c2053fbcd1d740aeec8b745d241e5703b88a37dcc3f30217dc084982d4
                                                                                                                                                                                                                                • Instruction ID: 9a5e40d3673fa200042a53b12821a8b4d85aad5f11b88b591063f3ea8c174268
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 58f382c2053fbcd1d740aeec8b745d241e5703b88a37dcc3f30217dc084982d4
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B0916D71A083419BD710DF65C884A5BB7E4FF88304F14893EF989A7390D738D9458B9E
                                                                                                                                                                                                                                Function 00444F70 Relevance: 6.2, APIs: 4, Instructions: 191fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetFileSizeEx.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,00445B8A,?,00000000,?), ref: 00444F8C
                                                                                                                                                                                                                                • SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,00445B8A,?,00000000,?), ref: 0044502B
                                                                                                                                                                                                                                • ReadFile.KERNEL32(?,?,00008000,?,00000000,?,?,?,?,?,00445B8A,?,00000000,?), ref: 00445047
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004450EE
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: File$PointerReadSize_memset
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1834740430-0
                                                                                                                                                                                                                                • Opcode ID: 42d80afe9b7eeef42009d056fd7f54964886481bb17fcda2694e9e0fe1f82d21
                                                                                                                                                                                                                                • Instruction ID: 4ac06d867bbb1af541f9e8b7180866f2b6a8720efad55de337094154612b3ff8
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 42d80afe9b7eeef42009d056fd7f54964886481bb17fcda2694e9e0fe1f82d21
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2751D2B16083005FF714DE29D880B5BB3E4EB88714F54892EF889D7341E739ED448B9A
                                                                                                                                                                                                                                Function 004107B0 Relevance: 6.2, APIs: 4, Instructions: 183COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00410805
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00410832
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041085F
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041088C
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3448037634-0
                                                                                                                                                                                                                                • Opcode ID: 88ecd01a23cdfb6e23e2d6a5cc136d438f4fff75d31412dd79b15a7d31735c97
                                                                                                                                                                                                                                • Instruction ID: 63b1fdf5856b1d4fd81a4ed39fda799eedd2a74137b0b32236926bcda4284eef
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 88ecd01a23cdfb6e23e2d6a5cc136d438f4fff75d31412dd79b15a7d31735c97
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9B6171B1904B448FD320EF69C881A4BB7E4FF44314F044E2EE59A97742DB38F8488B59
                                                                                                                                                                                                                                Function 0041E5F0 Relevance: 6.2, APIs: 4, Instructions: 177COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041E823
                                                                                                                                                                                                                                  • Part of subcall function 0041DA50: InterlockedDecrement.KERNEL32(?), ref: 0041DAD2
                                                                                                                                                                                                                                  • Part of subcall function 0041DA50: InterlockedDecrement.KERNEL32(429E9B72), ref: 0041DB49
                                                                                                                                                                                                                                  • Part of subcall function 0041DA50: InterlockedDecrement.KERNEL32(-0000000C), ref: 0041DB72
                                                                                                                                                                                                                                  • Part of subcall function 00426E80: InterlockedDecrement.KERNEL32(?), ref: 00426F3E
                                                                                                                                                                                                                                  • Part of subcall function 00426E80: InterlockedDecrement.KERNEL32(?), ref: 00426F67
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: LoadStringW.USER32(00400000,00477988,00000100,00000100), ref: 0040D78E
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: lstrlenW.KERNEL32(?,?,?,00477988), ref: 0040D7B5
                                                                                                                                                                                                                                  • Part of subcall function 00413B40: InterlockedIncrement.KERNEL32(0235D8A8), ref: 00413B5D
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041E72D
                                                                                                                                                                                                                                • CharLowerW.USER32(?), ref: 0041E755
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041E76F
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$CharIncrementLoadLowerStringlstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2258464383-0
                                                                                                                                                                                                                                • Opcode ID: c41ea7cf32227e625f321a952fab3163048de6724b62ad9e1a78f18323217fb9
                                                                                                                                                                                                                                • Instruction ID: aaea696b655ea362190aab85d33ca34e2ea28246111852f88c51237b06344f5b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c41ea7cf32227e625f321a952fab3163048de6724b62ad9e1a78f18323217fb9
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CA61FF759083819FD320DF25CC41B9BB3A4EF84314F444A2EF9558B2D1D738E949CB9A
                                                                                                                                                                                                                                Function 00445770 Relevance: 6.2, APIs: 4, Instructions: 175COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0044586B
                                                                                                                                                                                                                                • SetLastError.KERNEL32(00000008,?), ref: 0044587D
                                                                                                                                                                                                                                  • Part of subcall function 00444D10: GetFileSizeEx.KERNEL32(?,?,?,?,?,00000000,00000002,00443720,?,?,?,?,?,?,?,?), ref: 00444D29
                                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00445904
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044591A
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: __lock.LIBCMT ref: 0044FD25
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: ___sbh_find_block.LIBCMT ref: 0044FD30
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: ___sbh_free_block.LIBCMT ref: 0044FD3F
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: RtlFreeHeap.NTDLL(00000000,?,0047E7E8,0000000C,00456D67,00000000,?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C), ref: 0044FD6F
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: GetLastError.KERNEL32(?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C,00457324,?,?,?,00456E21,0000000D), ref: 0044FD80
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ErrorLast$FileFreeHeapSizeUnothrow_t@std@@@___sbh_find_block___sbh_free_block__ehfuncinfo$??2@__lock_malloc_memset
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2739003063-0
                                                                                                                                                                                                                                • Opcode ID: 24dff496384175f98e2b34446e61a2f7a93460ea9154aff972cac416fd8533a8
                                                                                                                                                                                                                                • Instruction ID: e9021e34d0a27d9097c6ed316b8c687f90dd40d6862771ae2dbe0db779c90255
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 24dff496384175f98e2b34446e61a2f7a93460ea9154aff972cac416fd8533a8
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E15171F1A047059FD710EF15D881A5BF7E4FB88314F44893EE99883302E779E9198BA6
                                                                                                                                                                                                                                Function 004191C0 Relevance: 6.2, APIs: 4, Instructions: 150COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(-000000F4), ref: 0041925D
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0041928A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004192B7
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004192E4
                                                                                                                                                                                                                                  • Part of subcall function 00414090: InterlockedDecrement.KERNEL32(?), ref: 004140D8
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3448037634-0
                                                                                                                                                                                                                                • Opcode ID: 2110655c232e42e684ed744000274d177ccd4236b33b32c44a7fa0aa781d7b73
                                                                                                                                                                                                                                • Instruction ID: e221455d5a9baa64a84816cc980ff8f99cfb21230fcb740fc9fe601c711ecab0
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2110655c232e42e684ed744000274d177ccd4236b33b32c44a7fa0aa781d7b73
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2A51E8B1604A86AFD304EB75C455BDAF794FF14318F44470EE86C93281DB3CA558C7AA
                                                                                                                                                                                                                                Function 0043A130 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • std::ios_base::clear.LIBCPMTD ref: 0043A17A
                                                                                                                                                                                                                                • std::ios_base::clear.LIBCPMTD ref: 0043A1A1
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: std::ios_base::clear
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1443086396-0
                                                                                                                                                                                                                                • Opcode ID: 4a9651de01f0e9cd20d1c55f6aeaceb37f7253be9eea05e615672a90a06527d2
                                                                                                                                                                                                                                • Instruction ID: eb866a87abe48610083d848cfc78c553e4c3c808c31d25f77b7c999067b7451f
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4a9651de01f0e9cd20d1c55f6aeaceb37f7253be9eea05e615672a90a06527d2
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1E51A1319803489EDB01DBA8D8D2BDD7770EF19314F50C16AE9653F2D1DB786A08CB6A
                                                                                                                                                                                                                                Function 0045370F Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __flush.LIBCMT ref: 004537D3
                                                                                                                                                                                                                                • __fileno.LIBCMT ref: 004537F3
                                                                                                                                                                                                                                • __locking.LIBCMT ref: 004537FA
                                                                                                                                                                                                                                • __flsbuf.LIBCMT ref: 00453825
                                                                                                                                                                                                                                  • Part of subcall function 004552A8: __getptd_noexit.LIBCMT ref: 004552A8
                                                                                                                                                                                                                                  • Part of subcall function 00450211: __decode_pointer.LIBCMT ref: 0045021C
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3240763771-0
                                                                                                                                                                                                                                • Opcode ID: d744e6d31eb5ac702f2bf66b2198ac434824ba9dceace317635c629eeb031214
                                                                                                                                                                                                                                • Instruction ID: 03656dfffa669713748f105f0a4cf035fdb08faa6e2d2e08aeff1dac628a9cbf
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d744e6d31eb5ac702f2bf66b2198ac434824ba9dceace317635c629eeb031214
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F941E6B1E00604ABCB159F65888055FBBF2AF807A7F24856EEC2597242D778DF49CB48
                                                                                                                                                                                                                                Function 004434C0 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 004434D9
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __FF_MSGBANNER.LIBCMT ref: 00450A95
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: __NMSG_WRITE.LIBCMT ref: 00450A9C
                                                                                                                                                                                                                                  • Part of subcall function 00450A72: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C,00457324), ref: 00450AE9
                                                                                                                                                                                                                                • SetLastError.KERNEL32(00000008,?), ref: 004434ED
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0044356F
                                                                                                                                                                                                                                • SetLastError.KERNEL32(00000008,?,?,?), ref: 00443583
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ErrorLast_malloc$AllocateHeap
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1551238847-0
                                                                                                                                                                                                                                • Opcode ID: b789299f73319a17ba91cf082ed046b823a4be266f73e9bc2e1feb8d04c848ce
                                                                                                                                                                                                                                • Instruction ID: 8f07195651be2ec550e24da48e1fd22233a21144017fff615759529a58bb857c
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b789299f73319a17ba91cf082ed046b823a4be266f73e9bc2e1feb8d04c848ce
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9341B4B16043415FE710EF25D841B6FB7E4AB84759F00093EF94A97341EA39DA098B5B
                                                                                                                                                                                                                                Function 0040B6C0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,429E9C66), ref: 0040B705
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 0040B751
                                                                                                                                                                                                                                • _memcpy_s.LIBCMT ref: 0040B7BD
                                                                                                                                                                                                                                • _memcpy_s.LIBCMT ref: 0040B7CF
                                                                                                                                                                                                                                  • Part of subcall function 0040B650: __recalloc.LIBCMT ref: 0040B65A
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memcpy_slstrlen$__recalloc
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1038713732-0
                                                                                                                                                                                                                                • Opcode ID: fa08d4e5fff2267d82ea3ef87ba648c49f1c61a5329bc88b434ed2c3467ecf03
                                                                                                                                                                                                                                • Instruction ID: f60ab3bb441f07c22d58bb84972eadf4346b74a925bbd5cada3e81fa2a6b1735
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fa08d4e5fff2267d82ea3ef87ba648c49f1c61a5329bc88b434ed2c3467ecf03
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A24174B1D012499FDB00DFA9D885AAFBBF8FB48314F10453FE505A7281D7799A018BE9
                                                                                                                                                                                                                                Function 00418E10 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: LoadStringW.USER32(00400000,00477988,00000100,00000100), ref: 0040D78E
                                                                                                                                                                                                                                  • Part of subcall function 0040D760: lstrlenW.KERNEL32(?,?,?,00477988), ref: 0040D7B5
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418EA8
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418F0A
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418F57
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00418F9C
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$LoadStringlstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 849870322-0
                                                                                                                                                                                                                                • Opcode ID: e6bfe0e591d2c5b3feb78ffb98c8624665855a69a11d9b390683d0daae9479e7
                                                                                                                                                                                                                                • Instruction ID: 6b2e43ac0d82c3fe75dbc1208bb15f1dc61e260c1e0928269540063693b12490
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e6bfe0e591d2c5b3feb78ffb98c8624665855a69a11d9b390683d0daae9479e7
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D441F772509B858FC320EB25DC4578FB7E4EF84319F00492EE55897292D738AA09CF9B
                                                                                                                                                                                                                                Function 00428DF0 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32 ref: 00428DF3
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CurrentProcess
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2050909247-0
                                                                                                                                                                                                                                • Opcode ID: 4729956c00a4a7b1ab17836438a1c14027b5f878bc57cf19d77e9213b4b449fc
                                                                                                                                                                                                                                • Instruction ID: ede327236a8a2ba377195717760b8084a1487e509e11593e9b0e5fd359e3c0a8
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4729956c00a4a7b1ab17836438a1c14027b5f878bc57cf19d77e9213b4b449fc
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3E31A775701200BBC710AB64FC49B5F7BA8EB85752F84483EF909C2291DB399509CB7A
                                                                                                                                                                                                                                Function 00465C02 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00465C36
                                                                                                                                                                                                                                • __isleadbyte_l.LIBCMT ref: 00465C6A
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000), ref: 00465C9B
                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000001,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000), ref: 00465D09
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3058430110-0
                                                                                                                                                                                                                                • Opcode ID: dee000dcbc1d71e5daef51907b0a6c08ba6218bc21e267a12712e3c224e36d40
                                                                                                                                                                                                                                • Instruction ID: a9ceee88cd41c7d0353f46362f377ddc882f8862d88c568cdd5bc49533dc0207
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dee000dcbc1d71e5daef51907b0a6c08ba6218bc21e267a12712e3c224e36d40
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 97319D31A00796EFDB20DF64CC849AE3BA5BF01311F1485AAE4659B291F334DD50DB5A
                                                                                                                                                                                                                                Function 0042E810 Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • FindResourceW.KERNEL32(?,?,00000005), ref: 0042E83A
                                                                                                                                                                                                                                • LoadResource.KERNEL32(?,00000000,?,00000005), ref: 0042E845
                                                                                                                                                                                                                                • LockResource.KERNEL32(00000000,?,00000005), ref: 0042E852
                                                                                                                                                                                                                                • FreeResource.KERNEL32(00000000,?,00000005), ref: 0042E8F2
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Resource$FindFreeLoadLock
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1078018258-0
                                                                                                                                                                                                                                • Opcode ID: 4feb012e3fd0af1454c28a53031c81e852685a9c5ece58c973ce3ccec5b8e725
                                                                                                                                                                                                                                • Instruction ID: c3f7a6a32b267e25f91b0f65c8fa65fdaae48be64aa33c34dd9c9b472fbf77b5
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4feb012e3fd0af1454c28a53031c81e852685a9c5ece58c973ce3ccec5b8e725
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2C319471B01725AFD310AF66EC09F2A77A5FF44701F40892AF90997280E778AC40CB99
                                                                                                                                                                                                                                Function 004397C0 Relevance: 6.1, APIs: 4, Instructions: 86COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: allocator
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3447690668-0
                                                                                                                                                                                                                                • Opcode ID: 52b474f3b090f547a662e3bcdd37063b2e6c274ce020f5e1e6a211a2381b36a0
                                                                                                                                                                                                                                • Instruction ID: 0c2022d56cd10d3f9e6d6a7138921890ace9b0d6f6d24120f2bdd0e68721192a
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 52b474f3b090f547a662e3bcdd37063b2e6c274ce020f5e1e6a211a2381b36a0
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BE316CB1D002099FDB04DB99D851BEFBBB9EB48318F14012EE505A7281D7796900CBA6
                                                                                                                                                                                                                                Function 0040D760 Relevance: 6.1, APIs: 4, Instructions: 82stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • LoadStringW.USER32(00400000,00477988,00000100,00000100), ref: 0040D78E
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,00477988), ref: 0040D7B5
                                                                                                                                                                                                                                • LoadStringW.USER32(00400000,00477988,00000000,00000000), ref: 0040D7EE
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00000000,?,?,00477988), ref: 0040D817
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: LoadStringlstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1897449643-0
                                                                                                                                                                                                                                • Opcode ID: 6f79e5c6afcbe44a25c16bff15e3a9f6d0edd7b5d2e5c09645561409062e40e2
                                                                                                                                                                                                                                • Instruction ID: ecc4abb7a37661db26ba89793e0714bbfe47a46cdba9c9bc89f74e92ae7859dd
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6f79e5c6afcbe44a25c16bff15e3a9f6d0edd7b5d2e5c09645561409062e40e2
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B721A471A043445BD324EFA9E889A6B77E8FF88304F10483EF945C3291EBB8D804C799
                                                                                                                                                                                                                                Function 004067C0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __recalloc_memmove_s
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1992126439-0
                                                                                                                                                                                                                                • Opcode ID: dc61d8d36f39961fcbb05b080b78224f287b2f9f38f743592363f229f3a071c7
                                                                                                                                                                                                                                • Instruction ID: 6fd701b313162f36833a336b1193618dabfef19f7a4a3be518f0e8e23124e0a8
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dc61d8d36f39961fcbb05b080b78224f287b2f9f38f743592363f229f3a071c7
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7A21F3B76007019BC720DB7ADC84E67B3EADBC0304715C92EE88687685FA39F845C750
                                                                                                                                                                                                                                Function 0042FA50 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0042FB30: _memset.LIBCMT ref: 0042FB50
                                                                                                                                                                                                                                  • Part of subcall function 0042FB30: GetVersionExW.KERNEL32 ref: 0042FB64
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00479EC4,00479EC4,?,?,?,00403B4E), ref: 0042FAA4
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(Tahoma,Tahoma,?,?,?,00403B4E), ref: 0042FAC0
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00479EB8,00479EB8,?,?,?,00403B4E), ref: 0042FADC
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: lstrlen$Version_memset
                                                                                                                                                                                                                                • String ID: Tahoma
                                                                                                                                                                                                                                • API String ID: 1582223139-3580928618
                                                                                                                                                                                                                                • Opcode ID: 3f8a677d0018cf56a8c61d570478e06a38ac166ba4bfcf365d0cbb709a0351bd
                                                                                                                                                                                                                                • Instruction ID: 2e270bfdffe62694d71c77c88bf9ecd3e35997dcf189ad3241bb5b8333a4fe83
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3f8a677d0018cf56a8c61d570478e06a38ac166ba4bfcf365d0cbb709a0351bd
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4F21D831B803157AE310A7619C06F96B764AB04B24F60C936FB5CB62C0E7F8B844875C
                                                                                                                                                                                                                                Function 00428F80 Relevance: 6.1, APIs: 4, Instructions: 71COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 00413EB0: InterlockedDecrement.KERNEL32(00000000), ref: 00413ECF
                                                                                                                                                                                                                                • OpenProcess.KERNEL32(00000410,00000000,00000000,00000000), ref: 00428FAE
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00428FD0
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042901C
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,?,00000104), ref: 0042904A
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$CloseDecrementHandleInterlockedOpenProcess
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 1463612311-0
                                                                                                                                                                                                                                • Opcode ID: d6cef22e05d41d5a6a5922cfd36d6a8f6ac049c7171fc6c707e567bec196fde0
                                                                                                                                                                                                                                • Instruction ID: 51c85a131987d0ace361cc11a168727af184c4240a9fc798918c03770daa16d8
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d6cef22e05d41d5a6a5922cfd36d6a8f6ac049c7171fc6c707e567bec196fde0
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3111A872A143545AD730EB759C45ADF73E8AF84704F400D3EB909D6292EA78D988829E
                                                                                                                                                                                                                                Function 00446C80 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetLastError.KERNEL32(00000005,?,?,771ADFA0,00446DD1,?,?,00444638,00000000,00000000,00000CCC,00000040,?,?,?,00004000), ref: 00446C8A
                                                                                                                                                                                                                                  • Part of subcall function 004552A8: __getptd_noexit.LIBCMT ref: 004552A8
                                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000,?,00444638,00000000,00000000,00000CCC,00000040,?,?,?,00004000), ref: 00446CA4
                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00444638,00000000,00000000,00000CCC,00000040,?,?,?,00004000), ref: 00446CB5
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ErrorLast$__getptd_noexit
                                                                                                                                                                                                                                • String ID: __crt
                                                                                                                                                                                                                                • API String ID: 101986603-4026493915
                                                                                                                                                                                                                                • Opcode ID: dadeeb46abaf743d1be8a8b0efe766721bdfcb790ad6bbccd9cde8168a1a169a
                                                                                                                                                                                                                                • Instruction ID: a105e16a0bf8aeff9850bcb2c1eeec844f8cce2d39d3dd64d137eaaead8caec6
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dadeeb46abaf743d1be8a8b0efe766721bdfcb790ad6bbccd9cde8168a1a169a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A71134B2B0021047E3206FB9D88026BF394DF62B66702457BE905CB311EB2ADC41C349
                                                                                                                                                                                                                                Function 00408800 Relevance: 6.1, APIs: 4, Instructions: 68stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(429E9B72), ref: 0040883A
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(-000000F4), ref: 0040887E
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00000000,?,?,00000000,00000000,0046C1A8,000000FF,00408978), ref: 0040889A
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: IncrementInterlocked$lstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 4011519848-0
                                                                                                                                                                                                                                • Opcode ID: 63839753e56bf9119fed0133a56a2f48563143695de57ebe7b22ccf0ceadb664
                                                                                                                                                                                                                                • Instruction ID: 45ac6081b8d1e23762f1f552cb9577f3e6c7be5261b11cb037e0cf2f22bc41b4
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 63839753e56bf9119fed0133a56a2f48563143695de57ebe7b22ccf0ceadb664
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2321BEB2604241DFC300DF25DD84B1AB7E8FB08728F548A3EE595E7390DB3CA8448B69
                                                                                                                                                                                                                                Function 00409220 Relevance: 6.1, APIs: 4, Instructions: 68stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(-000000F4), ref: 0040925B
                                                                                                                                                                                                                                • InterlockedIncrement.KERNEL32(?), ref: 004092A0
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,0046C1A8,000000FF), ref: 004092BC
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: IncrementInterlocked$lstrlen
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 4011519848-0
                                                                                                                                                                                                                                • Opcode ID: f7f8568ca32a5dd74cbaa35a425cd1cd688452e409ca9f4c56803161350b12ec
                                                                                                                                                                                                                                • Instruction ID: 39c3bdce0a4082b1f9583e3106b144a9d3387920568ff8350c6b8172b1ecc574
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f7f8568ca32a5dd74cbaa35a425cd1cd688452e409ca9f4c56803161350b12ec
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F7216AB1604241AFC700CF65D844B5AB7E8FB48728F104E3EE959E7791D738AC458BA9
                                                                                                                                                                                                                                Function 0040BA10 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?,?,00000000,00000025,0040BE43,?,429E9C66), ref: 0040BA19
                                                                                                                                                                                                                                  • Part of subcall function 0040B9D0: lstrcmpiW.KERNEL32(?,?,?,?,?,0040BA2C,?), ref: 0040B9EE
                                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,?), ref: 0040BA34
                                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,?), ref: 0040BA52
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CriticalSection$Leave$Enterlstrcmpi
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 431788158-0
                                                                                                                                                                                                                                • Opcode ID: 69ca380d9a34526e71ab33bc50f3ea98d362e0cc018ec5e76406237d53dd177f
                                                                                                                                                                                                                                • Instruction ID: d85fb9e849896a8383d9cd637fbfbacc948fc3e16f08db6c998407bb14f8a327
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 69ca380d9a34526e71ab33bc50f3ea98d362e0cc018ec5e76406237d53dd177f
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7FF0FC7230025597D6209BB8DCC4F8AF35CFB40765F004937F615E35A0C334A8858BE8
                                                                                                                                                                                                                                Function 00462A21 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3016257755-0
                                                                                                                                                                                                                                • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                                                                • Instruction ID: 94b095712ec0e01f3191c160a1099c5233adafeff07f813eecab56aa29a92e61
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6D11833200044EBBCF265ED5CD05CEE3F62BF18354B188516FE1859131E7BAC9B2AB86
                                                                                                                                                                                                                                Function 00416480 Relevance: 6.0, APIs: 4, Instructions: 32fileCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __time64.LIBCMT ref: 00416486
                                                                                                                                                                                                                                  • Part of subcall function 00450247: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00415E1B,00000000), ref: 00450252
                                                                                                                                                                                                                                  • Part of subcall function 00450247: __aulldiv.LIBCMT ref: 00450272
                                                                                                                                                                                                                                • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004164AE
                                                                                                                                                                                                                                • GetFileSizeEx.KERNEL32(00000000,?), ref: 004164C1
                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 004164CF
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: File$Time$CloseCreateHandleSizeSystem__aulldiv__time64
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3584427805-0
                                                                                                                                                                                                                                • Opcode ID: 30fe9c4cdd869e03c9ea94388e15cb294c39170f51b7ef42f212cdc6b16e5276
                                                                                                                                                                                                                                • Instruction ID: fc83ef211407164c99d3123e3afe61d316a280401fc5a32562af937801d60492
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 30fe9c4cdd869e03c9ea94388e15cb294c39170f51b7ef42f212cdc6b16e5276
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B3F09074500250BBD210EF2CCC89F87BAE4BB48314F008629FA59972E0D374E5908A99
                                                                                                                                                                                                                                Function 00451056 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 00451062
                                                                                                                                                                                                                                  • Part of subcall function 00456D76: __getptd_noexit.LIBCMT ref: 00456D79
                                                                                                                                                                                                                                  • Part of subcall function 00456D76: __amsg_exit.LIBCMT ref: 00456D86
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 00451079
                                                                                                                                                                                                                                • __amsg_exit.LIBCMT ref: 00451087
                                                                                                                                                                                                                                • __lock.LIBCMT ref: 00451097
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3521780317-0
                                                                                                                                                                                                                                • Opcode ID: 7a76a988947160a20b4a4cf702a8e93233863f8b758360c648977cc539556108
                                                                                                                                                                                                                                • Instruction ID: 35a385d58869e328948729a96ed7f3622f2b2d8ec12919f4a0dddf5635afe3d8
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7a76a988947160a20b4a4cf702a8e93233863f8b758360c648977cc539556108
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A5F0CD319006409BD720BB66880274E72B0AB00B2AF10465FED10AB6E3DB3C998D8B5A
                                                                                                                                                                                                                                Function 004046F0 Relevance: 6.0, APIs: 4, Instructions: 27threadCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 004046FB
                                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(0048D7B8,?,00419E8C,?,00418F76,00000000), ref: 00404709
                                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(0048D7B8,?,00419E8C,?,00418F76,00000000), ref: 00404722
                                                                                                                                                                                                                                • RaiseException.KERNEL32(C0000005,00000001,00000000,00000000,?,00419E8C,?,00418F76,00000000), ref: 00404735
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CriticalSection$CurrentEnterExceptionLeaveRaiseThread
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 2662421713-0
                                                                                                                                                                                                                                • Opcode ID: 4b59b345b8153a8d1fb1c4b2a7622be29feb431c0ad327cc864f4e4df1f3951c
                                                                                                                                                                                                                                • Instruction ID: 12c9223f8c4a9af7b9038119165eb3a18ed05893db4a42d580deed1dc54f861f
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4b59b345b8153a8d1fb1c4b2a7622be29feb431c0ad327cc864f4e4df1f3951c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 45E012749417819BE7205F74AD49B0D37A4FB05B12F50882EFA46E7EE0D77894808B5C
                                                                                                                                                                                                                                Function 0045077E Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00450791
                                                                                                                                                                                                                                  • Part of subcall function 00458CD0: __FindPESection.LIBCMT ref: 00458D2B
                                                                                                                                                                                                                                • __getptd_noexit.LIBCMT ref: 004507A1
                                                                                                                                                                                                                                • __freeptd.LIBCMT ref: 004507AB
                                                                                                                                                                                                                                • ExitThread.KERNEL32 ref: 004507B4
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3182216644-0
                                                                                                                                                                                                                                • Opcode ID: a329c9ffd989bb4fbcd90544066e7d0acdd995b2da1b3d75cb485f5849359619
                                                                                                                                                                                                                                • Instruction ID: 0e5307d9c0bd0f5205e00020c879e3698d8e25d4898a8a8e4d83d3906fcde063
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a329c9ffd989bb4fbcd90544066e7d0acdd995b2da1b3d75cb485f5849359619
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 14D0123800120157DA113BBBDC4A617369CAB45396FE9003BBC59851B3DFB8E889C96D
                                                                                                                                                                                                                                Function 0040FAB0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 268COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040FB28
                                                                                                                                                                                                                                  • Part of subcall function 00453FBC: RaiseException.KERNEL32(?,?,0044FE91,?,?,?,?,?,0044FE91,?,0047F018,0048E270), ref: 00453FFE
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 0040FD6D
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • invalid map/set<T> iterator, xrefs: 0040FAE5
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementExceptionException@8InterlockedRaiseThrow
                                                                                                                                                                                                                                • String ID: invalid map/set<T> iterator
                                                                                                                                                                                                                                • API String ID: 1869640917-152884079
                                                                                                                                                                                                                                • Opcode ID: 8a00a0cfe9dcc08baec558432d30ad71ab8ab49843fca718fc1923bf6cd7577a
                                                                                                                                                                                                                                • Instruction ID: 7bcbb95ada2c6dcc31ac3348a556a61246fc189db0b9426d2d9cf51bdd97645d
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8a00a0cfe9dcc08baec558432d30ad71ab8ab49843fca718fc1923bf6cd7577a
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EEB1A7B05483849FD725DF24C050A16BFE1BF99304F2446BEE4895BB92D339EC4ACB99
                                                                                                                                                                                                                                Function 00402C00 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 225COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • SysFreeString.OLEAUT32(?), ref: 00402D5F
                                                                                                                                                                                                                                • SysFreeString.OLEAUT32(?), ref: 00402DCB
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: FreeString
                                                                                                                                                                                                                                • String ID: HNetCfg.FwMgr
                                                                                                                                                                                                                                • API String ID: 3341692771-2685090254
                                                                                                                                                                                                                                • Opcode ID: f32c29bfec5a9d5aa1c0cf7de013d475536092f64347ae417696f170412019f7
                                                                                                                                                                                                                                • Instruction ID: 68f97ec27de2c84eabf922e97a53daa2a2559347242cad4889571797f8fcaeb2
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f32c29bfec5a9d5aa1c0cf7de013d475536092f64347ae417696f170412019f7
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 28811A75A01248EFCB00DFE8C984E9EB7B5EF89304F2485A9E505EB391C775AD46CB50
                                                                                                                                                                                                                                Function 00448BB0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _wcsnlen
                                                                                                                                                                                                                                • String ID: $\
                                                                                                                                                                                                                                • API String ID: 3628947076-1413047179
                                                                                                                                                                                                                                • Opcode ID: 39a0d0a5ebc2e9e4f7b6fb401e297912609824dffb5529d378b27c5bcae02510
                                                                                                                                                                                                                                • Instruction ID: 61695843c278a4eefb81b0a2abaf22ecac4af74bfd970c573d74c6b024a121c7
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 39a0d0a5ebc2e9e4f7b6fb401e297912609824dffb5529d378b27c5bcae02510
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5E619C716083018FE704DF28C885A5FB7E1FF95314F504A2EF465972D0EB39A949CBA6
                                                                                                                                                                                                                                Function 00422C00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00422C76
                                                                                                                                                                                                                                • IsWindow.USER32(?), ref: 00422CB9
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlockedWindow
                                                                                                                                                                                                                                • String ID: PNG
                                                                                                                                                                                                                                • API String ID: 796432368-364855578
                                                                                                                                                                                                                                • Opcode ID: 3125848779a54fd83c57eadecb6fb1278ba5e6564ffc427b3dab74c3d4607e85
                                                                                                                                                                                                                                • Instruction ID: 1dd3469a9dee9a7fdfed2e25adab321a9e605484bd7706b7616ff1a21f51a8b6
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3125848779a54fd83c57eadecb6fb1278ba5e6564ffc427b3dab74c3d4607e85
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E0418EB1604301ABC710DF28DC85E4BB7E9FF88714F100A2EF9589B295D774EA05CB9A
                                                                                                                                                                                                                                Function 0041CA60 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedIncrement.KERNEL32(00000000), ref: 00405119
                                                                                                                                                                                                                                  • Part of subcall function 004050C0: InterlockedDecrement.KERNEL32(-0000000C), ref: 00405155
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9C5A), ref: 0041CB85
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Interlocked$Decrement$Increment
                                                                                                                                                                                                                                • String ID: IDS_PRODUCT_NAME$PNG
                                                                                                                                                                                                                                • API String ID: 2574743344-3739555457
                                                                                                                                                                                                                                • Opcode ID: d89c7ceb4e19d316e8d573e6cbd0caab5a33d002a53ea6ced20e86a7864a27be
                                                                                                                                                                                                                                • Instruction ID: 84d87e2e7a4c2d18eb185f0a2f3b2e579421fbfe4024d0829d2852b919c60568
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d89c7ceb4e19d316e8d573e6cbd0caab5a33d002a53ea6ced20e86a7864a27be
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 253186B1744700AFD210EB25DC82F6BB3A9FB84B04F00492DF9459B2D1CB79F8048769
                                                                                                                                                                                                                                Function 00413B90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102stringCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 00405D00: InterlockedDecrement.KERNEL32(?), ref: 00405DA7
                                                                                                                                                                                                                                  • Part of subcall function 00405D00: InterlockedDecrement.KERNEL32(?), ref: 00405E13
                                                                                                                                                                                                                                  • Part of subcall function 0040A220: InterlockedDecrement.KERNEL32(?), ref: 0040A257
                                                                                                                                                                                                                                  • Part of subcall function 0040A220: InterlockedDecrement.KERNEL32(?), ref: 0040A27E
                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,00490474,?,?,429E9C66,00000000,0044C4F3,?), ref: 00413C19
                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(429E9C5A), ref: 00413C7B
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked$lstrlen
                                                                                                                                                                                                                                • String ID: font
                                                                                                                                                                                                                                • API String ID: 2495739296-3499362514
                                                                                                                                                                                                                                • Opcode ID: bb19048ca534d20f2ad1035c8f802aacaa12b226523d698f2ceae92141a5e378
                                                                                                                                                                                                                                • Instruction ID: 233a5dd038975e41278342a6c57c8274d0a898a0f3111f550067867f2b2006f7
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bb19048ca534d20f2ad1035c8f802aacaa12b226523d698f2ceae92141a5e378
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B63191761043409FC300DF59D845A9BB7A8FB89314F40493FF655933A1E738A949CBAA
                                                                                                                                                                                                                                Function 004296F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: String_base::_Xlen_memcpy_sstd::_
                                                                                                                                                                                                                                • String ID: \shell\open\command
                                                                                                                                                                                                                                • API String ID: 923394732-3053425699
                                                                                                                                                                                                                                • Opcode ID: a55576fe694cb78748521c7ef8dfc2147d8eb2f41032272f7f539bedcf5db7a0
                                                                                                                                                                                                                                • Instruction ID: 9dd2e710fba890d76126a7b5162e12ba51957b2a15e6223fdae5a6e67fea5825
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a55576fe694cb78748521c7ef8dfc2147d8eb2f41032272f7f539bedcf5db7a0
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1D21CB35720224CB8B24EE68E9D096AB3E6EFC6301B90452FD102CB755D739BC05C7AD
                                                                                                                                                                                                                                Function 00449130 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice, xrefs: 0044918B
                                                                                                                                                                                                                                • Progid, xrefs: 004491E0
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                • String ID: Progid$Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
                                                                                                                                                                                                                                • API String ID: 2102423945-1466444019
                                                                                                                                                                                                                                • Opcode ID: 31de33d4c6cbb15297a96d3a4194c6162b40e57860e71e3cd56168ac563c3ea8
                                                                                                                                                                                                                                • Instruction ID: cf5017816f758919364846291e93c6235116f6901b4d28ebfda03adff216cd3e
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 31de33d4c6cbb15297a96d3a4194c6162b40e57860e71e3cd56168ac563c3ea8
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C7317C71508340AFD324CF59D849B9BB7E8FFD8B14F108E2EF499822A0D778A504CB96
                                                                                                                                                                                                                                Function 00428AA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00428ADC
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00428B39
                                                                                                                                                                                                                                  • Part of subcall function 00429D00: _vswprintf_s.LIBCMT ref: 00429D36
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$_vswprintf_s
                                                                                                                                                                                                                                • String ID: %d.%d.%d.%d
                                                                                                                                                                                                                                • API String ID: 3424173483-3491811756
                                                                                                                                                                                                                                • Opcode ID: 42dec0374fa1f18f538ae9e287ef21c63507ad03f8e6777401e7a67c2f22ca5b
                                                                                                                                                                                                                                • Instruction ID: 0420a315ce757e63c08eb4f3f899cff24a13ec216509615c9a1f53178f35cb56
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 42dec0374fa1f18f538ae9e287ef21c63507ad03f8e6777401e7a67c2f22ca5b
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1121C3B16043106AF214EB11DC46F7F73E9DF88B04F89891EB948861C2EB7CE944D36A
                                                                                                                                                                                                                                Function 0042D560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042D598
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042D5F5
                                                                                                                                                                                                                                  • Part of subcall function 00429D00: _vswprintf_s.LIBCMT ref: 00429D36
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$_vswprintf_s
                                                                                                                                                                                                                                • String ID: %d.%d.%d.%d
                                                                                                                                                                                                                                • API String ID: 3424173483-3491811756
                                                                                                                                                                                                                                • Opcode ID: 7302c9a44b87d452ef078d684eef28693f9a9cc7d6e257e969c698cb98d56be6
                                                                                                                                                                                                                                • Instruction ID: 9c36f0a33311469a1eb82c02ed13daec69cf4373e4c40ff701cee30d83605185
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7302c9a44b87d452ef078d684eef28693f9a9cc7d6e257e969c698cb98d56be6
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EB21D571A042106EE224DB11DC46FBBB3E89F88B00F84891EB94C861C1E7BCD54887AA
                                                                                                                                                                                                                                Function 00416AB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __wcsicoll_memset
                                                                                                                                                                                                                                • String ID: EDIT
                                                                                                                                                                                                                                • API String ID: 3893915231-3080729518
                                                                                                                                                                                                                                • Opcode ID: f37d45b9dcaa1a02187b16f86d3306f44c925803648a389b1e1b165d6083e08c
                                                                                                                                                                                                                                • Instruction ID: b419d8a83791d8104be27becb6e91fcda3a2b3064281e84094b8ded515fc4589
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f37d45b9dcaa1a02187b16f86d3306f44c925803648a389b1e1b165d6083e08c
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F421D571A083069BDB20EB55D885AEBB365EB84704F118E2FF554D3291D738F888C79E
                                                                                                                                                                                                                                Function 0044A940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memcpy_s.LIBCMT ref: 0044A97E
                                                                                                                                                                                                                                • _memcpy_s.LIBCMT ref: 0044A993
                                                                                                                                                                                                                                  • Part of subcall function 0040C530: __CxxThrowException@8.LIBCMT ref: 0040C522
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memcpy_s$Exception@8Throw
                                                                                                                                                                                                                                • String ID: 360base.dll
                                                                                                                                                                                                                                • API String ID: 93487992-1892121520
                                                                                                                                                                                                                                • Opcode ID: 2d8b4c5d358d001cb8e525e1a715faf54f1d8350ab15f595cbd10b3e0f4de4a6
                                                                                                                                                                                                                                • Instruction ID: 83eeb894b1843c91143b43201f05e5c11a05669c35820dcd86a1c6ad38c5becb
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2d8b4c5d358d001cb8e525e1a715faf54f1d8350ab15f595cbd10b3e0f4de4a6
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8D01AD72200600AFD310DF6ECC889AFB7DAEFC8318F05842EF9099B355DA34AC0487A5
                                                                                                                                                                                                                                Function 0044ECD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0044ECF4
                                                                                                                                                                                                                                  • Part of subcall function 0044DD30: _memset.LIBCMT ref: 0044DD65
                                                                                                                                                                                                                                  • Part of subcall function 0044DD30: _memset.LIBCMT ref: 0044DE0B
                                                                                                                                                                                                                                  • Part of subcall function 0044DD30: _strncat.LIBCMT ref: 0044DE8F
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: _memset$_strncat
                                                                                                                                                                                                                                • String ID: Software\360Safe\Liveup$mid
                                                                                                                                                                                                                                • API String ID: 4289780381-2395435937
                                                                                                                                                                                                                                • Opcode ID: 1f155f4ac5a001d437af19cfdca7a56737ca3c929aef8fd93ff2bc09999a773b
                                                                                                                                                                                                                                • Instruction ID: 044888fdbb062e007281423c6de150a4c9ca4481f8de684ce3393cf6cb697f0b
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1f155f4ac5a001d437af19cfdca7a56737ca3c929aef8fd93ff2bc09999a773b
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 08110A71A04341AFE734DB25C851BEB77E8FF85700F54891EE58987281EE785A0C835A
                                                                                                                                                                                                                                Function 004117C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00411811
                                                                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 0041184A
                                                                                                                                                                                                                                  • Part of subcall function 00409F60: InterlockedDecrement.KERNEL32(-000000F4), ref: 00409F71
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: DecrementInterlocked__wcsicoll_memset
                                                                                                                                                                                                                                • String ID: EDIT
                                                                                                                                                                                                                                • API String ID: 1178333930-3080729518
                                                                                                                                                                                                                                • Opcode ID: c2b6feaecfb5632b3b9df74f6026d7f808c1583a0d3884a4bb85aaa199572062
                                                                                                                                                                                                                                • Instruction ID: 2e6ef5290f897ccdd32f5d85490bdd19c5f89abaea33dd92785e42f10c0e97d5
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c2b6feaecfb5632b3b9df74f6026d7f808c1583a0d3884a4bb85aaa199572062
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AE11E9719043059BD720FB55D8859DBB375EF84704F10CD2EF654A3261D738E888CB9A
                                                                                                                                                                                                                                Function 00429F10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 00429F40
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: __lock.LIBCMT ref: 0044FD25
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: ___sbh_find_block.LIBCMT ref: 0044FD30
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: ___sbh_free_block.LIBCMT ref: 0044FD3F
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: RtlFreeHeap.NTDLL(00000000,?,0047E7E8,0000000C,00456D67,00000000,?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C), ref: 0044FD6F
                                                                                                                                                                                                                                  • Part of subcall function 0044FD07: GetLastError.KERNEL32(?,00455146,?,00000001,?,?,00457293,00000018,0047EC08,0000000C,00457324,?,?,?,00456E21,0000000D), ref: 0044FD80
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • \StringFileInfo\%04x%04x, xrefs: 00429F94
                                                                                                                                                                                                                                • \VarFileInfo\Translation, xrefs: 00429F70
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock_malloc
                                                                                                                                                                                                                                • String ID: \StringFileInfo\%04x%04x$\VarFileInfo\Translation
                                                                                                                                                                                                                                • API String ID: 3256733112-2356763208
                                                                                                                                                                                                                                • Opcode ID: 19437e025cde729540f1ebbed9041050dd8daa9c2a44ac25737bbdaf0786acdb
                                                                                                                                                                                                                                • Instruction ID: 355e41240ca2e9a9edecf3571f12059060865ec724ee1494bb93dcebed61a3d5
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 19437e025cde729540f1ebbed9041050dd8daa9c2a44ac25737bbdaf0786acdb
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EC1186F1A012122BE310EB2A9C45BA7B7DCAF80724F45452BF805C6342FB28D91486A5
                                                                                                                                                                                                                                Function 0042A800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042A847
                                                                                                                                                                                                                                  • Part of subcall function 0042A7E0: __vswprintf.LIBCMT ref: 0042A7EB
                                                                                                                                                                                                                                • _wcsncpy.LIBCMT ref: 0042A8A6
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • {%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}, xrefs: 0042A88D
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __vswprintf_memset_wcsncpy
                                                                                                                                                                                                                                • String ID: {%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}
                                                                                                                                                                                                                                • API String ID: 74702585-891345449
                                                                                                                                                                                                                                • Opcode ID: 8d635969d5fbf19051dca42d77554e8f5e99a70e38e2371ac2d7a97718b4b88b
                                                                                                                                                                                                                                • Instruction ID: 34e7a1fc8b0f73e96742812cda9d852296f9e97103089f795e87f1060e264c8f
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8d635969d5fbf19051dca42d77554e8f5e99a70e38e2371ac2d7a97718b4b88b
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0811ACB15483506ED314DF65D841A7FB7F8AFC8701F40891EB8D8C2281E238DA089B77
                                                                                                                                                                                                                                Function 0045578A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 0045447F: __getptd.LIBCMT ref: 00454485
                                                                                                                                                                                                                                  • Part of subcall function 0045447F: __getptd.LIBCMT ref: 00454495
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 00455799
                                                                                                                                                                                                                                  • Part of subcall function 00456D76: __getptd_noexit.LIBCMT ref: 00456D79
                                                                                                                                                                                                                                  • Part of subcall function 00456D76: __amsg_exit.LIBCMT ref: 00456D86
                                                                                                                                                                                                                                • __getptd.LIBCMT ref: 004557A7
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: __getptd$__amsg_exit__getptd_noexit
                                                                                                                                                                                                                                • String ID: csm
                                                                                                                                                                                                                                • API String ID: 803148776-1018135373
                                                                                                                                                                                                                                • Opcode ID: f1e16be4bf64a34a6f9e6c2462ee636cb77070a6c3ae1c8ad402c94ae29f2356
                                                                                                                                                                                                                                • Instruction ID: a9128336e2c2d75cd31848e81c505413a8244ee6416793256377eac59a862f83
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f1e16be4bf64a34a6f9e6c2462ee636cb77070a6c3ae1c8ad402c94ae29f2356
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9E017834800A85DACF34DF21C450ABEB3B5AF18316F64442FEC565A662DF388989CB59
                                                                                                                                                                                                                                Function 0044D248 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 0044D24F
                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0044D27A
                                                                                                                                                                                                                                  • Part of subcall function 00453FBC: RaiseException.KERNEL32(?,?,0044FE91,?,?,?,?,?,0044FE91,?,0047F018,0048E270), ref: 00453FFE
                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                • invalid string position, xrefs: 0044D254
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ExceptionException@8H_prolog3RaiseThrow
                                                                                                                                                                                                                                • String ID: invalid string position
                                                                                                                                                                                                                                • API String ID: 1961742612-1799206989
                                                                                                                                                                                                                                • Opcode ID: 08b4f4269eb2cc2ad9c733f4f3a0077e51de9a74e73f4bc3680ed95c79222857
                                                                                                                                                                                                                                • Instruction ID: 023b3e0f26bb2452f32b3e59e2983d8a950a0f783609ab6ae6c516a93dcc2c92
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 08b4f4269eb2cc2ad9c733f4f3a0077e51de9a74e73f4bc3680ed95c79222857
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 30D0127195010CA7CB04EAE2C842FDDB3386F14719F54486BF201B6087DB7CA608862D
                                                                                                                                                                                                                                Function 00446DB0 Relevance: 5.1, APIs: 4, Instructions: 63COMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00446F0A,00000000,00000000,00477988,00000000,004444A3,004444A3,00000000,00000000,00477988,?,00444638,00000000), ref: 00446DB3
                                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000,?,00444638,00000000,00000000,00000CCC,00000040,?,?,?,00004000), ref: 00446DC0
                                                                                                                                                                                                                                  • Part of subcall function 00446C80: GetLastError.KERNEL32(00000005,?,?,771ADFA0,00446DD1,?,?,00444638,00000000,00000000,00000CCC,00000040,?,?,?,00004000), ref: 00446C8A
                                                                                                                                                                                                                                  • Part of subcall function 00446C80: SetLastError.KERNEL32(00000000,?,00444638,00000000,00000000,00000CCC,00000040,?,?,?,00004000), ref: 00446CA4
                                                                                                                                                                                                                                  • Part of subcall function 00446C80: GetLastError.KERNEL32(?,00444638,00000000,00000000,00000CCC,00000040,?,?,?,00004000), ref: 00446CB5
                                                                                                                                                                                                                                • SetLastError.KERNEL32(?,?,?,00444638,00000000,00000000,00000CCC,00000040,?,?,?,00004000), ref: 00446DE6
                                                                                                                                                                                                                                  • Part of subcall function 004552A8: __getptd_noexit.LIBCMT ref: 004552A8
                                                                                                                                                                                                                                • SetLastError.KERNEL32(?,?,?,00444638,00000000,00000000,00000CCC,00000040,?,?,?,00004000), ref: 00446E27
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: ErrorLast$__getptd_noexit
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 101986603-0
                                                                                                                                                                                                                                • Opcode ID: 49929ada7cdcd6d7b76d8f667e5806bf935c924583a2aea2ded98b5b40a11662
                                                                                                                                                                                                                                • Instruction ID: 5d880ac6e19c24ffdd259baddad0fa8ae85bcc92126aebc15aaca8fd4b22f27e
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 49929ada7cdcd6d7b76d8f667e5806bf935c924583a2aea2ded98b5b40a11662
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7411A5757006018BD220DB99D8C49AB73E9EB86326F15483EF549C7710C738EC89CB6A
                                                                                                                                                                                                                                Function 0044CF2B Relevance: 5.1, APIs: 4, Instructions: 59memoryCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,0000000D,00000000,0040474E,?,?,00419E8C,?,00418F76,00000000), ref: 0044CEAC
                                                                                                                                                                                                                                • HeapAlloc.KERNEL32(00000000,?,00419E8C,?,00418F76,00000000), ref: 0044CEB3
                                                                                                                                                                                                                                  • Part of subcall function 0044CDC4: IsProcessorFeaturePresent.KERNEL32(0000000C,0044CE9A,00000000,0040474E,?,?,00419E8C,?,00418F76,00000000), ref: 0044CDC6
                                                                                                                                                                                                                                • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00419E8C,?,00418F76,00000000), ref: 0044CED5
                                                                                                                                                                                                                                • VirtualFree.KERNEL32(00000000,00000000,00008000,?,00419E8C,?,00418F76,00000000), ref: 0044CF02
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: AllocHeapVirtual$FeatureFreePresentProcessProcessor
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 4058086966-0
                                                                                                                                                                                                                                • Opcode ID: 14855552f56f77d71b18de2d9cb6465b1318905f6b62ef7bbd5bc8d5b7fbfc67
                                                                                                                                                                                                                                • Instruction ID: 243d512c456e60e98efadf02b9f20583b396ad812edbda86f0d87fc62e6535d5
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 14855552f56f77d71b18de2d9cb6465b1318905f6b62ef7bbd5bc8d5b7fbfc67
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3F01C439A07211ABF7A16768BC88B2F3755EB84751F280436F905D62E0CB39CC81866C
                                                                                                                                                                                                                                Function 00447CD0 Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON
                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                  • Part of subcall function 004479F0: GetProcessHeap.KERNEL32(429E9C66), ref: 00447A19
                                                                                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00447D0C
                                                                                                                                                                                                                                • HeapFree.KERNEL32(00000000), ref: 00447D0F
                                                                                                                                                                                                                                • GetProcessHeap.KERNEL32(008D4568), ref: 00447D2D
                                                                                                                                                                                                                                • HeapFree.KERNEL32(00000000,00000000,008D4568), ref: 00447D37
                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                • Source File: 00000015.00000002.1506313062.0000000000401000.00000020.00000001.01000000.00000012.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1506200839.0000000000400000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507002111.0000000000471000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507085302.0000000000487000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507300556.0000000000488000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507585350.000000000048B000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1507942759.000000000048C000.00000008.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508089463.000000000048D000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.0000000000492000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000052E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                • Associated: 00000015.00000002.1508142856.000000000056E000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_400000_r0raHcCIH1k2YsFlLn2OIQyk.jbxd
                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                • API ID: Heap$Process$Free
                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                • API String ID: 3168794593-0
                                                                                                                                                                                                                                • Opcode ID: 1557864c4f27be99603819de59b2298a77ebf5cfebf38630baf89d7652874814
                                                                                                                                                                                                                                • Instruction ID: f3ced8ed782fcf3bac3c404d3ddc50f79a6fef867c347e8f8b3615a854c51af9
                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1557864c4f27be99603819de59b2298a77ebf5cfebf38630baf89d7652874814
                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 21F036B5A142016AFB205B6ADC45F2737ACEF54755F14083BE904D72A1DB2CDC058ABC